Improper access control in grafana (Alpine package)
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2019-15043 |
| CWE-ID | CWE-284 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software Subscribe |
grafana (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Improper access control
EUVDB-ID: #VU20497
Risk: Medium
CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2019-15043
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper access restrictions to Grafana HTTP API. A remote non-authenticated attacker can send a specially crafted request to unprotected Garafa API endpoint and perform denial of service (DoS) attack.
Install update from vendor's website.
Vulnerable software versionsgrafana (Alpine package): 6.3.3-r1
External linkshttp://git.alpinelinux.org/aports/commit/?id=6b9f41629e03645cd466375b5c865746ff6c28e3
http://git.alpinelinux.org/aports/commit/?id=c5b06ed9d6196d039de125c6f98fc3144a41375f
http://git.alpinelinux.org/aports/commit/?id=2802ad0f181ff87865d7f9c27b5e79fc0c0f42a9
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
