CVE-2018-15727 Grafana Authentication Bypass
Attackers can bypass authentication and take over accounts by generating valid remember-me cookies for LDAP or OAuth users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-15727?
CVE-2018-15727 is a critical authentication bypass vulnerability in Grafana Grafana, published on 29 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
Weakness: CWE-287
Which versions are affected by CVE-2018-15727?
5 open source packages ship an affected version, including github.com/grafana/grafana. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | 4.6.4+incompatible, 5.2.3+incompatible |
github.com/grafana/grafana Go | All versions | 4.6.4 |
github.com/grafana/grafana Go | All versions | 4.6.4 |
github.com/grafana/grafana Go | From 5.0.0 | 5.2.3 |
github.com/grafana/grafana Go | From 5.0.0 | 5.2.3 |
Linux distribution packages (10)
tendrl-gluster-integration Red Hat:storage:3.4:na:el7 | All versions | 0:1.6.3-13.el7rhgs |
tendrl-node-agent Red Hat:storage:3.4:na:el7 | All versions | 0:1.6.3-11.el7rhgs |
grafana Red Hat:storage:3.4:wa:el7 | All versions | 0:4.6.4-1.el7rhgs |
tendrl-ansible Red Hat:storage:3.4:wa:el7 | All versions | 0:1.6.3-10.el7rhgs |
tendrl-api Red Hat:storage:3.4:wa:el7 | All versions | 0:1.6.3-8.el7rhgs |
tendrl-api-httpd Red Hat:storage:3.4:wa:el7 | All versions | 0:1.6.3-8.el7rhgs |
tendrl-grafana-plugins Red Hat:storage:3.4:wa:el7 | All versions | 0:1.6.3-16.el7rhgs |
tendrl-monitoring-integration Red Hat:storage:3.4:wa:el7 | All versions | 0:1.6.3-16.el7rhgs |
tendrl-node-agent Red Hat:storage:3.4:wa:el7 | All versions | 0:1.6.3-11.el7rhgs |
tendrl-ui Red Hat:storage:3.4:wa:el7 | All versions | 0:1.6.3-14.el7rhgs |
Products include Grafana Grafana, Redhat Ceph Storage.
How do I fix CVE-2018-15727?
Upgrade github.com/grafana/grafana to a fixed version for your release line: 4.6.4+incompatible, 5.2.3+incompatible, 4.6.4 or 5.2.3.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-15727 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-15727 exists.
Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.
Other vulnerabilities in Grafana Grafana
Sources
Also known as CVE-2018-558213, GHSA-rgjg-66cx-5x9m, GO-2022-0707, RHSA-2018:3829, UBUNTU-CVE-2018-15727.