CVE-2023-1387 Information disclosure in Grafana

What is CVE-2023-1387?

CVE-2023-1387 is a medium-severity vulnerability in Grafana Grafana, published on 26 Apr 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Grafana is an open-source platform for monitoring and observability.

Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token.

By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

Weakness: CWE-200

Which versions are affected by CVE-2023-1387?

1 open source package ship an affected version, including grafana. It affects 1 product.

Products include Grafana Grafana.

How do I fix CVE-2023-1387?

Upgrade grafana to a fixed version for your release line: 9.2.17, 9.3.13 or 9.4.9.

Is CVE-2023-1387 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1387 exists.

Other vulnerabilities in Grafana Grafana

• CVE-2021-43798 Grafana Path Traversal Exploited High 7.5
• CVE-2025-41115 Incorrect privilege assignment Critical 10.0
• CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation Critical 9.8
• CVE-2022-28660 Auth bypass in n/a Critical 9.8
• CVE-2022-26148 Information disclosure in n/a Critical 9.8

All Grafana Grafana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as BIT-grafana-2023-1387, GHSA-5585-m9r5-p86j, GHSA-c3h9-vpfv-3x4m, UBUNTU-CVE-2023-1387, openSUSE-SU-2024:12890-1.