CVE-2018-15727
published 2018-08-29CVE-2018-15727: Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing…
PriorityP273critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
64.28%
99.1th percentile
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | grafana_grafana | >= 0 < 4.6.4+incompatible | 4.6.4+incompatible |
| github.com | grafana_grafana | >= 0 < 4.6.4 | 4.6.4 |
| github.com | grafana_grafana | >= 5.0.0 < 5.2.3 | 5.2.3 |
| github.com | grafana_grafana | >= 5.0.0+incompatible < 5.2.3+incompatible | 5.2.3+incompatible |
| grafana | grafana | 2.0.0 – 2.1.2 | — |
| grafana | grafana | 3.0.0 – 3.1.1 | — |
| grafana | grafana | >= 4.0.0 < 4.6.4 | 4.6.4 |
| grafana | grafana | >= 5.0.0 < 5.2.3 | 5.2.3 |
| redhat | ceph_storage | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for authentication sessions established via forged 'remember me' cookies for LDAP or OAuth-backed Grafana users, particularly where no corresponding interactive login event exists. ↗
- →Patch commits for the vulnerability are available for code-level review: 5.2.x fix at commit df83bf10a225811927644bdf6265fa80bdea9137 and 4.6.x fix at commit 7baecf0d0deae0d865e45cf03e082bc0db3f28c3 on the Grafana GitHub repository. ↗
- ·Vulnerability only affects Grafana instances configured to use LDAP or OAuth authentication; deployments using other authentication mechanisms are not affected. ↗
- ·Affected versions are Grafana 2.x, 3.x, 4.x before 4.6.4, and 5.x before 5.2.3; upgrade to 4.6.4 or 5.2.3 to remediate. ↗
- ·Upstream recommends switching to a non-LDAP/OAuth authentication mechanism or isolating Grafana from public networks as interim mitigations. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Grafana Authentication Bypass in github.com/grafana/grafana
osv·2024-08-21
CVE-2018-15727 Grafana Authentication Bypass in github.com/grafana/grafana
Grafana Authentication Bypass in github.com/grafana/grafana
Grafana Authentication Bypass in github.com/grafana/grafana
GHSA
Grafana Authentication Bypass
ghsa·2022-02-15
CVE-2018-15727 [CRITICAL] CWE-287 Grafana Authentication Bypass
Grafana Authentication Bypass
Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
### Specific Go Packages Affected
github.com/grafana/grafana/pkg/api
OSV
Grafana Authentication Bypass
osv·2022-02-15
CVE-2018-15727 [CRITICAL] Grafana Authentication Bypass
Grafana Authentication Bypass
Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
### Specific Go Packages Affected
github.com/grafana/grafana/pkg/api
OSV
CVE-2018-15727: Grafana 2
osv·2018-08-29·CVSS 9.8
CVE-2018-15727 [CRITICAL] CVE-2018-15727: Grafana 2
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
Red Hat
grafana: authentication bypass knowing only a username of an LDAP or OAuth user
vendor_redhat·2018-08-29·CVSS 9.8
CVE-2018-15727 [CRITICAL] CWE-287 grafana: authentication bypass knowing only a username of an LDAP or OAuth user
grafana: authentication bypass knowing only a username of an LDAP or OAuth user
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
Mitigation: As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix)
* Switch to authentication mechanism other than LDAP or OAuth
* Grafana should be isolated from public networks
Package: grafana (Red Hat Ceph Storage 2) - Will not fix
Package: grafana (Red Hat OpenStack Platform 8 (Liberty) Operational Tools) - Will not fix
Package: grafana (Red Hat OpenStack Platform 9 (Mitaka) Operational Tools) - Will not fix
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/105184https://access.redhat.com/errata/RHSA-2018:3829https://access.redhat.com/errata/RHSA-2019:0019https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix/http://www.securityfocus.com/bid/105184https://access.redhat.com/errata/RHSA-2018:3829https://access.redhat.com/errata/RHSA-2019:0019https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix/
2018-08-29
Published