CVE-2022-26148

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

53.44% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-312

Published

2022-03-21

Updated

2024-08-03

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26148.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2022-26148.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-26147
• CVE-2022-26149
• CVE-2022-26143
• CVE-2022-26155
• CVE-2022-26138
• CVE-2022-26156