<p>There is no fixed version for <code>Centos:9</code> <code>grafana</code>.</p>

Authentication Bypass by Primary Weakness Affecting grafana package, versions *

Threat Intelligence

1.2% (86^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-CENTOS9-GRAFANA-3150950
published 30 Nov 2022
disclosed 29 Nov 2022

Report a new vulnerability Found a mistake?

Introduced: 29 Nov 2022

CVE-2022-46146 Open this link in a new tab CWE-305 Open this link in a new tab

How to fix?

There is no fixed version for Centos:9 grafana.

NVD Description

Note: Versions mentioned in the description apply only to the upstream grafana package and not the grafana package as distributed by Centos. See How to fix? for Centos:9 relevant fixed versions and status.

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

Low
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

High
Integrity (I)

High
Availability (A)

High

Authentication Bypass by Primary Weakness Affecting grafana package, versions *

Severity

Based on CentOS security rating