Vulnerability Description
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana | <= 7.3.4 |
| Redhat | Ceph Storage | 3.0 |
| Redhat | Storage | 3.0 |
Related Weaknesses (CWE)
References
- https://2k8.org/post-319.htmlExploitThird Party Advisory
- https://security.netapp.com/advisory/ntap-20220425-0005/Third Party Advisory
- https://2k8.org/post-319.htmlExploitThird Party Advisory
- https://security.netapp.com/advisory/ntap-20220425-0005/Third Party Advisory
FAQ
What is CVE-2022-26148?
CVE-2022-26148 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to re...
How severe is CVE-2022-26148?
CVE-2022-26148 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-26148?
Check the references section above for vendor advisories and patch information. Affected products include: Grafana Grafana, Redhat Ceph Storage, Redhat Storage.