CVE-2022-26148

high-risk
Published 2022-03-21

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.

Do I need to act?

!
90.2% chance of exploitation in next 30 days
EPSS score — higher than 10% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (5)

Affected Vendors

Redhat Grafana

References (4)

Exploit https://2k8.org/post-319.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20220425-0005/
Exploit https://2k8.org/post-319.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20220425-0005/
64
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 20/34 · Moderate
Exposure 12/34 · Low