7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.014 Low
EPSS
Percentile
86.6%
Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid “remember me” cookie knowing only a username of an LDAP or OAuth user.
CPE | Name | Operator | Version |
---|---|---|---|
github.com/grafana/grafana | lt | 5.2.3 | |
github.com/grafana/grafana | lt | 4.6.4 |
access.redhat.com/errata/RHSA-2018:3829
access.redhat.com/errata/RHSA-2019:0019
github.com/advisories/GHSA-rgjg-66cx-5x9m
github.com/grafana/grafana/commit/7baecf0d0deae0d865e45cf03e082bc0db3f28c3
github.com/grafana/grafana/commit/df83bf10a225811927644bdf6265fa80bdea9137
grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix/
nvd.nist.gov/vuln/detail/CVE-2018-15727
www.securityfocus.com/bid/105184
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.014 Low
EPSS
Percentile
86.6%