Grafana has released security updates to address an authentication bypass/account takeover vulnerability. CVE-2023-3128 has been rated as critical with a CVSSv3.1 base score of 9.4. Successful exploitation of the vulnerability will allow an attacker to gain complete control of a user’s account, including access to private customer data and sensitive information. Grafana is a multi-platform … Continue reading “Grafana Critical Authentication Bypass Vulnerability (CVE-2023-3128)”
Tag: Grafana
Grafana Releases Patches for Multiple Vulnerabilities (CVE-2022-39328, CVE-2022-39306, and CVE-2022-39307)
Grafana has advised its users to patch a critical severity elevation of privilege vulnerability (CVE-2022-39328) via a security advisory. The advisory also addressed two moderate severity vulnerabilities. CVE-2022-39306 is an elevation privilege vulnerability and CVE-2022-39307 is a username enumeration vulnerability. Grafana is a multi-platform open-source analytics and interactive visualization web application. It provides charts, graphs, … Continue reading “Grafana Releases Patches for Multiple Vulnerabilities (CVE-2022-39328, CVE-2022-39306, and CVE-2022-39307)”
Grafana Releases Fix for Zero-day Vulnerability Exploited in the Wild (CVE-2021-43798)
Grafana Labs released an emergency security upgrade to fix a zero-day flaw that permitted remote access to local files. Security researchers released proof-of-concept code to exploit the flaw over the weekend. Before Grafana Labs gave out patches for affected versions 8.0.0-beta1 through 8.3.0, details regarding the issue became public earlier this week. Tracked as CVE-2021-43798, this is … Continue reading “Grafana Releases Fix for Zero-day Vulnerability Exploited in the Wild (CVE-2021-43798)”
Grafana SSRF Vulnerability (CVE-2020-13379)
On 3rd June 2020, Grafana published a security advisory addressing CVE-2020-13379, SSRF (Server-side request forgery) Incorrect Access Control issue. This is a high-severity vulnerability with a CVSS score of 6.4. Vulnerability Details The avatar feature in Grafana has an SSRF Incorrect Access Control issue. This allows unauthenticated attackers to force Grafana to send HTTP requests … Continue reading “Grafana SSRF Vulnerability (CVE-2020-13379)”