PT-2020-17278 · Influxdata · Chronograf
Published
2020-12-17
·
Updated
2021-01-04
·
CVE-2020-35188
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
chronograf versions prior to 1.7.7-alpine
Description
The official chronograf docker images contain a blank password for a root user, which may allow a remote attacker to achieve root access with a blank password. This issue affects systems using the chronograf docker container deployed by affected versions of the docker image.
Recommendations
For versions prior to 1.7.7-alpine, update to version 1.7.7-alpine or later to resolve the issue. As a temporary workaround, consider changing the root password to a secure value until a patch is applied. Restrict access to the chronograf docker container to minimize the risk of exploitation.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Chronograf