CVE-2022-26148

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.
References
Link Resource
https://2k8.org/post-319.html Exploit Third Party Advisory
https://security.netapp.com/advisory/ntap-20220425-0005/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage:3.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-03-21 20:15

Updated : 2024-02-28 19:09


NVD link : CVE-2022-26148

Mitre link : CVE-2022-26148

CVE.ORG link : CVE-2022-26148


JSON object : View

Products Affected

grafana

  • grafana

redhat

  • ceph_storage
  • storage
CWE
CWE-312

Cleartext Storage of Sensitive Information