CVE-2019-15043 Missing authorization in n/a
Unauthenticated access to Grafana HTTP API allows attackers to launch denial of service attacks against the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-15043?
CVE-2019-15043 is a high-severity missing authorization vulnerability in Grafana Grafana, published on 3 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
Weakness: CWE-306
Which versions are affected by CVE-2019-15043?
It affects 1 product.
Linux distribution packages (14)
grafana Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-azure-monitor Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-cloudwatch Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-elasticsearch Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-graphite Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-influxdb Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-loki Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-mssql Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-mysql Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-opentsdb Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-postgres Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-prometheus Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
grafana-stackdriver Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-1.el8 |
Products include Grafana Grafana.
How do I fix CVE-2019-15043?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-15043 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-15043 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Grafana Grafana
Sources
Also known as GHSA-c6x5-653c-4grh, RHSA-2020:1659, UBUNTU-CVE-2019-15043.