CVE-2022-26148
Critical
Description
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Grafana
PublishedMar 21, 2022
First seenMar 21, 2022
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grafana grafana | v ≤ 7.3.4 | — |
| redhat ceph_storage | 3.0, 4.0, 5.0 | — |
| redhat storage | 3.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.