REDHAT-BUG-2066563: Medium severity grafana labs grafana oss and enterprise vulnerability
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the apijsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in apijsonrpc.php to discover the Zabbix account password and URL address.
https://2k8.org/post-319.html
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2066563?
The severity of REDHAT-BUG-2066563 is classified as a moderate security risk due to the exposure of sensitive information.
How do I fix REDHAT-BUG-2066563?
To fix REDHAT-BUG-2066563, update Grafana to a version later than 7.3.4 to ensure that passwords are not exposed.
Who is affected by REDHAT-BUG-2066563?
Users of Grafana versions up to and including 7.3.4 integrated with Zabbix are affected by REDHAT-BUG-2066563.
What data is exposed in REDHAT-BUG-2066563?
REDHAT-BUG-2066563 exposes the Zabbix password in the source code of the api_jsonrpc.php page.
How can I verify if I am affected by REDHAT-BUG-2066563?
To verify if you are affected by REDHAT-BUG-2066563, check if your Grafana version is 7.3.4 or earlier and if it is integrated with Zabbix.