CVE-2022-26148 Information disclosure in n/a
Attackers can view the Zabbix account password and URL in the HTML source code when Grafana is integrated with Zabbix and user registration is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-26148?
CVE-2022-26148 is a critical vulnerability in Grafana Grafana, published on 21 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.
Weakness: CWE-312
Which versions are affected by CVE-2022-26148?
1 open source package ship an affected version, including grafana. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | All versions | 7.3.5 |
Products include Grafana Grafana, Redhat Ceph Storage, Redhat Storage.
How do I fix CVE-2022-26148?
Upgrade grafana to 7.3.5 or later.
Is CVE-2022-26148 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-26148 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2022-26148, GHSA-97c5-jw9r-3fwj, UBUNTU-CVE-2022-26148.