Skip to content
OpenAdvisories
Critical RHSA-2019:0019 2 CVEs

Red Hat Security Advisory: grafana security and bug fix update

Published Sep 18, 2024 · Updated Jun 28, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Ceph Storage 3 ceph_storage:3::el7 grafana 0:5.2.4-1.el7cp

Vulnerabilities 2

  • Critical 9.8
    CVE-2018-15727 Public exploit EPSS 63%

    Grafana Authentication Bypass

    Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

    grafana github.com/grafana/grafana Ubuntu Go
  • Medium 6.1
    CVE-2018-18623

    Grafana XSS in Dashboard Text Panel

    Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

    grafana github.com/grafana/grafana Ubuntu Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1624088
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1633825
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1647494
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1647496
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1652427
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1653273
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0019.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-15727
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-15727
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-15727
  • report
    https://access.redhat.com/security/cve/CVE-2018-18623
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1850568
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-18623
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-18623
  • article
    https://security.netapp.com/advisory/ntap-20200608-0008/