Skip to content
Fencer Intel
critical 9.8

CVE-2018-15727 in the critical feed json

Grafana Authentication Bypass

published 8y ago modified 4mo ago also GHSA-rgjg-66cx-5x9m , GO-2022-0707 , EUVD-2022-1171

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
63.1%
EPSS 63.1% chance of exploitation in 30 days, percentile 99.2%
public exploits
1
Metasploit

Summary

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

Patch / fix

  • go github.com/grafana/grafana 4.6.4, 4.6.4+incompatible, 5.2.3, 5.2.3+incompatible
  • grafana grafana 4.6.4, 5.2.3
  • grafana ceph storage 3 5.2.4-1.el7cp
  • grafana storage 3.4 4.6.4-1.el7rhgs
  • tendrl-ui storage 3.4 1.6.3-14.el7rhgs
  • tendrl-api storage 3.4 1.6.3-8.el7rhgs
  • tendrl-ansible storage 3.4 1.6.3-10.el7rhgs
  • tendrl-api-httpd storage 3.4 1.6.3-8.el7rhgs
  • tendrl-node-agent storage 3.4 1.6.3-11.el7rhgs
  • tendrl-grafana-plugins storage 3.4 1.6.3-16.el7rhgs

red hat advisories RHSA-2019:0019RHSA-2018:3829

  • grafana Enterprise Storage 5 4.6.5-3.10.1
  • novnc OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.0.0-3.6.3
  • grafana OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 4.6.5-4.6.3
  • mariadb OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 10.2.25-4.14.2
  • galera-3 OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 25.3.25-4.6.3
  • crowbar-ha OpenStack Cloud Crowbar 8 5.0+git.1567673535.607aada-3.26.2
  • crowbar-ui OpenStack Cloud Crowbar 8 1.2.0+git.1568396400.0344a727-3.12.3
  • python-ovs OpenStack Cloud Crowbar 8, OpenStack Cloud 8 2.7.2-3.6.1

suse advisories SUSE-SU-2020:1273-1SUSE-SU-2019:2867-1SUSE-SU-2019:2671-1

Is CVE-2018-15727 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-15727 updated cvss 5.5

grafana: authentication bypass knowing only a username of an LDAP or OAuth user

  • Red Hat Ceph Storage 2 grafana Red Hat OpenStack Platform 8 (Liberty) Operational Tools grafana Red Hat OpenStack Platform 9 (Mitaka) Operational Tools grafana
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ceph Storage 3.2 Tools grafana 5.2.4-1.el7cp
    fixed: vendor fix RHSA-2019:0019
  • Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7 tendrl-node-agent 1.6.3-11.el7rhgs, tendrl-gluster-integration 1.6.3-13.el7rhgs Red Hat Gluster 3.4 Web Administration on RHEL-7 grafana 4.6.4-1.el7rhgs, tendrl-api 1.6.3-8.el7rhgs, tendrl-ui 1.6.3-14.el7rhgs, tendrl-ansible 1.6.3-10.el7rhgs, tendrl-api-httpd 1.6.3-8.el7rhgs, tendrl-node-agent 1.6.3-11.el7rhgs, +2 more
    fixed: vendor fix RHSA-2018:3829

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (Metasploit auxiliary/admin/http/grafana_auth_bypass)

Exploit prediction

63.12% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/grafana/grafana
<4.6.4
>=5.0.0, <5.2.3
<4.6.4+incompatible
>=5.0.0+incompatible, <5.2.3+incompatible
4.6.4
5.2.3
4.6.4+incompatible
5.2.3+incompatible

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.