CVE-2019-15635

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-15635
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15635.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-15635
Downstream
Published
2019-09-23T17:15:11.173Z
Modified
2026-07-08T15:55:33.068133Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, the password for the data source is revealed and sent to the server. From a browser, a prompt to save the credentials is generated, and the password can be revealed by simply checking the "Show password" box.

References

Affected packages

Git / github.com/grafana/grafana

Affected ranges

Type
GIT
Repo
https://github.com/grafana/grafana
Events
Introduced
69c519192657c4735a3b9d8a3bd31ef34ccbb8a5
Last affected
69c519192657c4735a3b9d8a3bd31ef34ccbb8a5
Database specific 
{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:grafana:grafana:5.4.0:-:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.4.0-NA"
        },
        {
            "last_affected": "5.4.0-NA"
        }
    ]
}

Affected versions

5.*
5.4.0-NA
v5.*
v5.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15635.json"