CVE-2023-1387

CVSS V2 None CVSS V3 None

Description

Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

Overview

CVE ID
CVE-2023-1387

Assigner
security@grafana.com

Vulnerability Status
Received

Published Version
2023-04-26T14:15:09

Last Modified Date
2023-04-26T14:15:09

Weakness Enumerations

CWE	URL
CWE-200	http://cwe.mitre.org/data/definitions/200.html

References

Reference URL	Reference Tags
https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j
https://grafana.com/security/security-advisories/cve-2023-1387/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-1387
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1387

History

Created	Old Value	New Value	Data Type	Notes
2023-04-26 15:01:17				Added to TrackCVE
2023-04-26 15:01:21			Weakness Enumeration	new