CVE-2023-1387

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-1387
Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

4.2 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j Exploit Vendor Advisory
https://grafana.com/security/security-advisories/cve-2023-1387/ Vendor Advisory
https://security.netapp.com/advisory/ntap-20230609-0003/
https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j Exploit Vendor Advisory
https://grafana.com/security/security-advisories/cve-2023-1387/ Vendor Advisory
https://security.netapp.com/advisory/ntap-20230609-0003/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
History

13 Feb 2025, 17:15

Type Values Removed Values Added
Summary (en) Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana. (en) Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

21 Nov 2024, 07:39

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 4.2
References () https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j - Exploit, Vendor Advisory () https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j - Exploit, Vendor Advisory
References () https://grafana.com/security/security-advisories/cve-2023-1387/ - Vendor Advisory () https://grafana.com/security/security-advisories/cve-2023-1387/ - Vendor Advisory
References () https://security.netapp.com/advisory/ntap-20230609-0003/ - () https://security.netapp.com/advisory/ntap-20230609-0003/ -

09 Jun 2023, 08:15

Type Values Removed Values Added
References
  • (MISC) https://security.netapp.com/advisory/ntap-20230609-0003/ -

09 May 2023, 16:39

Type Values Removed Values Added
CPE cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE NVD-CWE-noinfo
References (MISC) https://grafana.com/security/security-advisories/cve-2023-1387/ - (MISC) https://grafana.com/security/security-advisories/cve-2023-1387/ - Vendor Advisory
References (MISC) https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j - (MISC) https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j - Exploit, Vendor Advisory

26 Apr 2023, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-26 14:15

Updated : 2025-02-13 17:15

NVD link : CVE-2023-1387

Mitre link : CVE-2023-1387

CVE.ORG link : CVE-2023-1387

JSON object : View

Products Affected

grafana

  • grafana
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo