CVE-2023-5123

🗓️ 14 Feb 2024 15:06:11Reported by GRAFANAType

cve🔗 web.nvd.nist.gov👁 71 Views🌐 WEB

The JSON datasource plugin in Grafana allows path traversal leading to potential privilege escalatio

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2023-5123	10 Jan 202513:07	–	circl
CNNVD	Grafana Security Vulnerabilities	14 Feb 202400:00	–	cnnvd
Cvelist	CVE-2023-5123 Improper Path Sanitization in JSON Datasource Plugin	14 Feb 202415:06	–	cvelist
EUVD	EUVD-2023-57461	3 Oct 202520:07	–	euvd
Grafana	Improper Path Sanitization in JSON Datasource Plugin	14 Feb 202400:00	–	grafana
NVD	CVE-2023-5123	14 Feb 202415:15	–	nvd
OSV	CVE-2023-5123	14 Feb 202415:15	–	osv
Prion	Path traversal	14 Feb 202415:15	–	prion
Positive Technologies	PT-2024-14076	14 Feb 202400:00	–	ptsecurity
RedhatCVE	CVE-2023-5123	23 May 202502:39	–	redhatcve

NVD

Node

grafana json_api_data_sourceRange<1.3.21grafana

[
  {
    "defaultStatus": "unaffected",
    "product": "grafana-json-datasource",
    "repo": "https://github.com/grafana/grafana-json-datasource",
    "vendor": "Grafana",
    "versions": [
      {
        "lessThan": "1.3.21",
        "status": "affected",
        "version": "0.2.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
grafana	www.grafana.com/security/security-advisories/cve-2023-5123/
security	www.security.netapp.com/advisory/ntap-20240503-0007/

Parameter	Position	Path	Description	CWE
path	path	example.com/api/some_safe_api/	Path traversal vulnerability via the plugin's path parameter allows querying subpaths outside the configured sub-path.	CWE-22
path	path	example.com/api/admin_api/	Path traversal vulnerability via the plugin's path parameter allows querying arbitrary subpaths on the configured endpoint.	CWE-22

06 Jan 2026 16:54Current

7.9High risk

Vulners AI Score7.9

CVSS 3.18

EPSS0.00514

SSVC

CWE-22