CVE-2022-23498
grafana: Use of Cache Containing Sensitive Information
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 3, 2023
Updated · November 4, 2026
Description
A flaw was found in the Grafana package. When data-source query caching is enabled, Grafana caches all headers, including grafana_session. As a result, any user that queries a data source where the caching is enabled can acquire another user’s session.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
To mitigate the vulnerability, disable the data source query caching for all data sources.
CVSS / CWE
CVSS 3.1 · 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor