Most recent entries from all

bdu:2024-02593

BIT-grafana-2023-1387

Affected: Bitnami: grafana

Grafana is an open-source platform for monitoring and observability.

Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token.

By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

cnvd-2023-36311

EUVD-2026-216153

fkie_cve-2023-1387

Grafana is an open-source platform for monitoring and observability.

Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token.

GHSA-c3h9-vpfv-3x4m

Grafana is an open-source platform for monitoring and observability.

Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token.

gsd-2023-1387

openSUSE-SU-2024:12890-1 — grafana-9.5.1-1.1 on GA media

grafana-9.5.1-1.1 on GA media

RHSA-2023:7741 — Red Hat Security Advisory: Red Hat Ceph Storage 6.1 security, enhancements, and bug fix update

grafana: JWT token leak to data source grafana: Stored XSS in Graphite FunctionDescription tooltip grafana: missing access control allows test alerts by underprivileged user grafana: data source proxy race condition golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

SUSE-SU-2023:2575-1 — Security update for SUSE Manager Client Tools

Security update for SUSE Manager Client Tools

UBUNTU-CVE-2023-1387

Affected: Ubuntu:16.04:LTS: grafana

Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

WID-SEC-W-2023-1088 — Grafana: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Informationen offenzulegen und einen Denial of Service Zustand zu verursachen.