Vulnerability CVE-2023-1387: Information
Description
Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.
Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| grafana | sisyphus | 9.5.5-alt1 | 10.2.2-alt1.1 | ALT-PU-2023-4148-1 | 323937 | Fixed |
| grafana | p10 | 9.5.5-alt1 | 10.2.2-alt1.1 | ALT-PU-2023-4133-1 | 323967 | Fixed |
| grafana | c10f1 | 9.5.5-alt1 | 10.2.2-alt1.1 | ALT-PU-2023-4346-2 | 324663 | Fixed |
| grafana | c9f2 | 9.5.5-alt1 | 9.5.5-alt1 | ALT-PU-2023-4567-3 | 323137 | Fixed |
| grafana | p11 | 9.5.5-alt1 | 10.2.2-alt1.1 | ALT-PU-2023-4148-1 | 323937 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://grafana.com/security/security-advisories/cve-2023-1387/ |
|
| https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j |
|
| https://security.netapp.com/advisory/ntap-20230609-0003/ |