CVE-2023-1387
published 2023-04-26CVE-2023-1387: Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.50%
71.1th percentile
Grafana is an open-source platform for monitoring and observability.
Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token.
By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | >= 9.1.0 < 9.2.17 | 9.2.17 |
| grafana | grafana | >= 9.3.0 < 9.3.13 | 9.3.13 |
| grafana | grafana | >= 9.4.0 < 9.5.0 | 9.5.0 |
| grafana | grafana | >= 9.4.0 < 9.4.9 | 9.4.9 |
| grafana | grafana_enterprise | >= 9.1.0 < 9.2.17 | 9.2.17 |
| grafana | grafana_enterprise | >= 9.3.0 < 9.3.13 | 9.3.13 |
| grafana | grafana_enterprise | >= 9.4.0 < 9.5.0 | 9.5.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_redhat4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
grafana: JWT token leak to data source
vendor_redhat·2023-04-12·CVSS 4.2
CVE-2023-1387 [MEDIUM] CWE-200 grafana: JWT token leak to data source
grafana: JWT token leak to data source
Grafana is an open-source platform for monitoring and observability.
Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token.
By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.
A flaw was found in Grafana. This flaw allows a remote, authenticated attacker to obtain sensitive information caused by an issue when enabling the "url_login" configuration option. By sending a specially crafted request, an attacker can obtain JWT information and use this to launch further attacks against the affec
GHSA
GHSA-c3h9-vpfv-3x4m: Grafana is an open-source platform for monitoring and observability
ghsa_unreviewed·2023-04-26
CVE-2023-1387 [HIGH] CWE-200 GHSA-c3h9-vpfv-3x4m: Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability.
Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token.
By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.
OSV
CVE-2023-1387: Grafana is an open-source platform for monitoring and observability
osv·2023-04-26·CVSS 7.5
CVE-2023-1387 [HIGH] CVE-2023-1387: Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86jhttps://grafana.com/security/security-advisories/cve-2023-1387/https://security.netapp.com/advisory/ntap-20230609-0003/https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86jhttps://grafana.com/security/security-advisories/cve-2023-1387/https://security.netapp.com/advisory/ntap-20230609-0003/
2023-04-26
Published