Test ID:	1.3.6.1.4.1.25623.1.0.149589
Category:	Web application abuses
Title:	Grafana 9.1.0 < 9.2.17, 9.3.x < 9.3.13, 9.4.x < 9.4.9 Information Disclosure Vulnerability
Summary:	Grafana is prone to an information disclosure vulnerability.
Description:	Summary: Grafana is prone to an information disclosure vulnerability. Vulnerability Insight: Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the 'url_login' configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana. Affected Software/OS: Grafana versions starting from 9.1.0 and prior to 9.2.17, 9.3.x prior to 9.3.13 and 9.4.x prior to 9.4.9. Solution: Update to version 9.2.17, 9.3.13, 9.4.9 or later. CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-1387 https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j https://grafana.com/security/security-advisories/cve-2023-1387/
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.