{"id":"CVE-2023-5122","aliases":["BIT-grafana-2023-5122","EUVD-2023-57460","GHSA-4pff-25fv-cm83"],"status":"published","title":"SSRF in CSV Datasource Plugin","description":"Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no path (e.g.  https://www.example.com/ https://www.example.com/` ), requests to an endpoint other than the one configured by the administrator could be triggered by a specially crafted request from any user, resulting in an SSRF vector. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00509,"percentile":0.43946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2024-02-14T15:06:12Z","modified":"2026-09-08T08:47:51Z","fixes":[{"ecosystem":"Bitnami","package":"grafana","fixed_in":["0.6.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.13"}]}]}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"grafana","product":"grafana-csv-datasource"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2023-5122/","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240503-0002/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5122","tags":["web"]},{"url":"https://grafana.com/security/security-advisories/cve-2023-5122"},{"url":"https://security.netapp.com/advisory/ntap-20240503-0002"},{"url":"https://github.com/advisories/GHSA-4pff-25fv-cm83"}],"sources":{"cve":[{"id":"CVE-2023-5122","title":"SSRF in CSV Datasource Plugin","description":"Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no path (e.g.  https://www.example.com/ https://www.example.com/` ), requests to an endpoint other than the one configured by the administrator could be triggered by a specially crafted request from any user, resulting in an SSRF vector. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator","status":"published","published":"2024-02-14T15:06:12.573Z","modified":"2025-02-13T17:19:42.98Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:35:17.149492Z"}],"euvd":[{"id":"EUVD-2023-57460","description":"Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no path (e.g.  https://www.example.com/ https://www.example.com/` ), requests to an endpoint other than the one configured by the administrator could be triggered by a specially crafted request from any user, resulting in an SSRF vector. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator","status":"published","published":"2024-02-14T15:06:12Z","modified":"2025-02-13T17:19:42Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:48.029386Z"}],"ghsa":[{"id":"GHSA-4pff-25fv-cm83","title":"Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is...","description":"Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no path (e.g.  https://www.example.com/ https://www.example.com/` ), requests to an endpoint other than the one configured by the administrator could be triggered by a specially crafted request from any user, resulting in an SSRF vector. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator \n","status":"published","published":"2024-02-14T18:30:24Z","modified":"2026-03-14T05:09:18Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:06:37.566427Z"}],"nvd":[{"id":"CVE-2023-5122","description":"Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no path (e.g.  https://www.example.com/ https://www.example.com/` ), requests to an endpoint other than the one configured by the administrator could be triggered by a specially crafted request from any user, resulting in an SSRF vector. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator","status":"published","published":"2024-02-14T15:15:08.437Z","modified":"2026-06-17T06:47:34.78Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:09:07.077422Z"}],"osv":[{"id":"BIT-grafana-2023-5122","title":"SSRF in CSV Datasource Plugin","description":"Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no path (e.g.  https://www.example.com/ https://www.example.com/` ), requests to an endpoint other than the one configured by the administrator could be triggered by a specially crafted request from any user, resulting in an SSRF vector. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator","status":"published","published":"2024-10-24T07:10:55.187Z","modified":"2026-09-08T08:47:51.384457821Z","updated_at":"2026-11-02T15:28:31.02759Z"}]}}