CVE-2019-15635

Description

From CVE.org

An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, the password for the data source is revealed and sent to the server. From a browser, a prompt to save the credentials is generated, and the password can be revealed by simply checking the "Show password" box.

Statement

Grafana instances packaged with OpenShift Container Platform (OCP) are read-only by default, see [1]. OCP is rated as low because when a user with the correct roles, [2], accesses the Grafana dashboard the data source settings menu is not available by default - preventing access to the plain-text credentials.

[1] https://docs.openshift.com/container-platform/3.11/install_config/prometheus_cluster_monitoring.html#accessing-prometheus-alertmanager-and-grafana_prometheus-cluster-monitoring

[2] https://docs.openshift.com/container-platform/4.2/monitoring/cluster-monitoring/prometheus-alertmanager-and-grafana.html#monitoring-accessing-prometheus-alertmanager-grafana-directly_accessing-prometheus

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score4.94.9N/A
Attack VectorNetworkNetworkN/A
Attack ComplexityLowLowN/A
Privileges RequiredHighHighN/A
User InteractionNoneNoneN/A
ScopeUnchangedUnchangedN/A
ConfidentialityHighHighN/A
Integrity ImpactNoneNoneN/A
Availability ImpactNoneNoneN/A

Vector

Red Hat: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

NVD: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Understanding the Weakness (CWE)

CWE-522

Access Control

Technical Impact: Gain Privileges or Assume Identity

An attacker could gain access to user accounts and access sensitive data used by the user accounts.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.