Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Grafana Insufficiently Protected Credentials Vulnerability - CVE-2019-15635 - Vulnerability Database
Grafana

Grafana Insufficiently Protected Credentials Vulnerability - CVE-2019-15635

Medium
Reference: CVE-2019-15635
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-15635
Title: Grafana Insufficiently Protected Credentials Vulnerability
Overview:

An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g. MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the quotSave and testquot button within a data source39s settings menu. When watching the transaction with Burp Proxy the password for the data source is revealed and sent to the server. From a browser a prompt to save the credentials is generated and the password can be revealed by simply checking the quotShow passwordquot box.