Description

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.

Remediation

References

CVE-2022-26148

Related Vulnerabilities

Java Denial of Service (DoS) Vulnerability (CVE-2018-3180)

WordPress Plugin Dynamic Widgets Multiple Unspecified Vulnerabilities (1.5.7)

Atlassian Jira Missing Authorization Vulnerability (CVE-2020-14185)

Oracle JRE CVE-2012-5069 Vulnerability (CVE-2012-5069)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Open Redirect (2.0.5)

Severity

Critical

Classification

CVE-2022-26148 CWE-312 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities