GHSA-rgjg-66cx-5x9mCriticalCVSS 9.8

Grafana Authentication Bypass

Published
February 15, 2022
Last Modified
October 2, 2023

🔗 CVE IDs covered (1)

CVE-2018-15727 →

📋 Description

Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

Specific Go Packages Affected

github.com/grafana/grafana/pkg/api

🎯 Affected products2

  • go/github.com/grafana/grafana:< 4.6.4
  • go/github.com/grafana/grafana:>= 5.0.0, < 5.2.3

🔗 References (8)