CVE-2023-4457

MEDIUM

Grafana Google Sheets Data Source Plugin 0.9.0-1.2.2 - Information Disclosure via Unsanitized Error Messages

Title source: llm

Description

Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability. The plugin did not properly sanitize error messages, making it potentially expose the Google Sheet API-key that is configured for the data source. This vulnerability was fixed in version 1.2.2.

References (1)

Core 1

Core References

Vendor Advisory

https://grafana.com/security/security-advisories/cve-2023-4457/

Scores

CVSS v3 5.5

EPSS 0.0039

EPSS Percentile 30.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-209

Status published

Products (2)

grafana/google-sheets-datasource 0.9.0 - 1.2.2Go

grafana/google_sheets 0.9.0 - 1.2.2

Published Oct 16, 2023

Tracked Since Feb 18, 2026