PT-2019-14309 · Mysql Server+1 · Mysql Server+1

Publicado 2019-09-23 · Atualizado 2022-04-22 · CVE-2019-15635

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grafana version 5.4.0

Description An issue in Grafana allows an admin user to reveal passwords for data sources, such as MySQL, by pressing the "Save and test" button within a data source's settings menu. The password is sent to the server and can be revealed using tools like Burp Proxy. Additionally, a browser prompt to save credentials is generated, and the password can be revealed by checking the "Show password" box.

Recommendations For Grafana version 5.4.0, consider restricting access to the data source settings menu to minimize the risk of password revelation until a fix is available. As a temporary workaround, avoid using the "Save and test" button within a data source's settings menu to prevent password exposure.

Correção

Cleartext Transmission of Sensitive Information

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-319

CWE-522

Identificadores relacionados

CVE-2019-15635

Produtos afetados

Grafana

Mysql Server

Referências · 8

• https://ubuntu.com/security/CVE-2019-15635 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15635 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/167244 · Nota
• https://cve.org/CVERecord?id=CVE-2019-15635 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15635 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15635 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15635 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20191009-0002 · Nota