Skip to content
CVE PROGRAM SOURCE RECORD4.2 Medium

CVE-2023-1387

Grafana is an open-source platform for monitoring and observability.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana

  • 9.1.0 to < 9.2.17affected
  • 9.3.0 to < 9.3.13affected
  • 9.4.0 to < 9.5.0affected

Grafana Grafana Enterprise

  • 9.1.0 to < 9.2.17affected
  • 9.3.0 to < 9.3.13affected
  • 9.4.0 to < 9.5.0affected

References