Grafana Vulnerabilities and Affected Products
Vulnerabilities associated with grafana_enterprise.
Products
Clear product- grafana59 vulnerabilities
- Grafana OSS21 vulnerabilities
- Grafana Enterprise16 vulnerabilities
- grafana/grafana4 vulnerabilities
- grafana/grafana-enterprise4 vulnerabilities
- Tempo3 vulnerabilities
- Enterprise Traces (GET)2 vulnerabilities
- Grafana MCP Server2 vulnerabilities
- grafana-image-renderer2 vulnerabilities
- grafana_enterprise2 vulnerabilities
- Loki2 vulnerabilities
- agent1 vulnerability
- Agent Flow1 vulnerability
- agent_flow_windows1 vulnerability
- Alloy1 vulnerability
- google-sheets-datasource1 vulnerability
- Grafana Alerting1 vulnerability
- Grafana Correlations1 vulnerability
- Grafana IRM1 vulnerability
- Grafana Operator1 vulnerability
- grafana-csv-datasource1 vulnerability
- grafana-infinity-datasource1 vulnerability
- grafana-json-datasource1 vulnerability
- grafana-zabbix-plugin1 vulnerability
- mcp-grafana1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-6152MEDIUM | Email Validation Bypass And Preventing Sign Up From Email's OwnerA user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. CWE-863Feb 13, 2024 | CVSS5.4v3.1 | EPSS1.39% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-4822MEDIUM | Grafana privilege escalation vulnerabilityGrafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally. This means that any Organization Admin … CWE-269Oct 16, 2023 | CVSS6.7v3.1 | EPSS1.07% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |