CVE-2019-15635 Information disclosure in n/a

What is CVE-2019-15635?

CVE-2019-15635 is a medium-severity vulnerability in Grafana Grafana, published on 23 Sep 2019. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, the password for the data source is revealed and sent to the server. From a browser, a prompt to save the credentials is generated, and the password can be revealed by simply checking the "Show password" box.

Weakness: CWE-522, CWE-319

Which versions are affected by CVE-2019-15635?

It affects 1 product.

Products include Grafana Grafana.

How do I fix CVE-2019-15635?

No fix has been published for CVE-2019-15635 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-15635 being exploited?

There is no known exploitation of CVE-2019-15635 in the wild and no public exploit code.

Other vulnerabilities in Grafana Grafana

• CVE-2021-43798 Grafana Path Traversal Exploited High 7.5
• CVE-2025-41115 Incorrect privilege assignment Critical 10.0
• CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation Critical 9.8
• CVE-2022-28660 Auth bypass in n/a Critical 9.8
• CVE-2022-26148 Information disclosure in n/a Critical 9.8

All Grafana Grafana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vfhw-75mr-pg52, UBUNTU-CVE-2019-15635.