Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-c3h9-vpfv-3x4m

Опубликовано: 26 апр. 2023
Источник: github
Github: Не прошло ревью
CVSS3: 4.2

Описание

Grafana is an open-source platform for monitoring and observability.

Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token.

By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

Grafana is an open-source platform for monitoring and observability.

Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token.

By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

EPSS

Процентиль: 50%
0.00269
Низкий

4.2 Medium

CVSS3

Дефекты

CWE-200

Связанные уязвимости

CVSS3: 4.2
ubuntu
около 2 лет назад

Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

CVSS3: 7.5
redhat
около 2 лет назад

Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

CVSS3: 4.2
nvd
около 2 лет назад

Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

CVSS3: 4.2
debian
около 2 лет назад

Grafana is an open-source platform for monitoring and observability. ...

CVSS3: 7.5
fstec
около 2 лет назад

Уязвимость платформы для мониторинга и наблюдения Grafana, связанная с раскрытие конфиденциальной информации несанкционированному субъекту, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 50%
0.00269
Низкий

4.2 Medium

CVSS3

Дефекты

CWE-200