Red Hat Security AdvisoryRHSA-2019:0019
grafana security and bug fix update
Released 2019-01-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Ceph Storage 3.2 Tools grafana-5.2.4-1.el7cp
Fixes 2 records
Priority HIGH 77
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.63124 · Published 2018-08-29 · Partial fix · 4.6.4, 5.2.3 CWE-287
Priority LOW 31
Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01806 · Published 2020-06-02 · Partial fix · 6.0.0-beta1 CWE-79
