CVE-2018-15727: vulnerability facts

CVE-2018-15727

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

CVSS 9.8 · Critical · EPSS 64.3% · Public exploit

Published: 2018-08-29T15:00:00.000Z
Updated: 2024-08-05T10:01:54.541Z

Stack: system · applications

Affected products and versions

n/a
Versions
- n/a: Affected
No fix published
grafana Ubuntu:16.04:LTS
Versions
- 2.6.0+dfsg-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published

Original sources

http://www.securityfocus.com/bid/105184
https://access.redhat.com/errata/RHSA-2019:0019
https://access.redhat.com/errata/RHSA-2018:3829
https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix/
https://nvd.nist.gov/vuln/detail/CVE-2018-15727

Check your server →

CVE-2018-15727

Affected products and versions

n/a

grafana Ubuntu:16.04:LTS

Original sources