Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-26148

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.

Published

2022-03-21T20:15:14.030

Last Modified

2024-11-21T06:53:31.593

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-312
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application grafana grafana ≤ 7.3.4 Yes
Application redhat ceph_storage 3.0 Yes
Application redhat ceph_storage 4.0 Yes
Application redhat ceph_storage 5.0 Yes
Application redhat storage 3.0 Yes
References