Information Exposure Affecting grafana-elasticsearch package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CENTOS8-GRAFANAELASTICSEARCH-3111479
- published 9 Nov 2022
- disclosed 8 Nov 2022
How to fix?
There is no fixed version for Centos:8 grafana-elasticsearch.
NVD Description
Note: Versions mentioned in the description apply only to the upstream grafana-elasticsearch package and not the grafana-elasticsearch package as distributed by Centos.
See How to fix? for Centos:8 relevant fixed versions and status.
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the /api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.