CVE-2018-15727
highPriorität · beachten · 71EPSS 0.643 · 99. PerzentilExploit · funktionalCHDEEURUUSEPSS · bewertet 2026-10-22
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobengrafana-0:4.6.4-1.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobengrafana-0:4.6.4-1.el7rhgs.x86_64 as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-ansible-0:1.6.3-10.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-ansible-0:1.6.3-10.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-api-0:1.6.3-8.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-api-0:1.6.3-8.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-api-httpd-0:1.6.3-8.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-gluster-integration-0:1.6.3-13.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-gluster-integration-0:1.6.3-13.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-grafana-plugins-0:1.6.3-16.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-monitoring-integration-0:1.6.3-16.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-monitoring-integration-0:1.6.3-16.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-node-agent-0:1.6.3-11.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-node-agent-0:1.6.3-11.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-node-agent-0:1.6.3-11.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-node-agent-0:1.6.3-11.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-ui-0:1.6.3-14.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobentendrl-ui-0:1.6.3-14.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2018:3829 - Behobengrafana-0:5.2.4-1.el7cp.src as a component of Red Hat Ceph Storage 3.2 Toolsredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:0019 - Behobengrafana-0:5.2.4-1.el7cp.x86_64 as a component of Red Hat Ceph Storage 3.2 Toolsredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:0019 - Behobenballuff_psirt
Update to the firmware version 2.4.1.
- BehobenLabX Standardmettler_toledo_psirt
Update to LabX Standard v21.4.23
- Workaroundgrafana-0:4.6.4-1.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundgrafana-0:4.6.4-1.el7rhgs.x86_64 as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-ansible-0:1.6.3-10.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-ansible-0:1.6.3-10.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-api-0:1.6.3-8.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-api-0:1.6.3-8.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-api-httpd-0:1.6.3-8.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-gluster-integration-0:1.6.3-13.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-gluster-integration-0:1.6.3-13.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-grafana-plugins-0:1.6.3-16.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-monitoring-integration-0:1.6.3-16.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-monitoring-integration-0:1.6.3-16.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-node-agent-0:1.6.3-11.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-node-agent-0:1.6.3-11.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-node-agent-0:1.6.3-11.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-node-agent-0:1.6.3-11.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-ui-0:1.6.3-14.el7rhgs.noarch as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundtendrl-ui-0:1.6.3-14.el7rhgs.src as a component of Red Hat Gluster 3.4 Web Administration on RHEL-7redhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundgrafana-0:5.2.4-1.el7cp.src as a component of Red Hat Ceph Storage 3.2 Toolsredhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
- Workaroundgrafana-0:5.2.4-1.el7cp.x86_64 as a component of Red Hat Ceph Storage 3.2 Toolsredhat_csaf
As per upstream (https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix) * Switch to authentication mechanism other than LDAP or OAuth * Grafana should be isolated from public networks
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 5.5–9.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (2)
Öffentlicher Proof-of-Concept- und Exploit-Code.
betroffene Produkte (45)
Betroffene Produkte und Versionsbereiche.
- Firmware 2.4.1 installed on BAV MA-NC-00025-01alle Versionenfixedballuff_psirtDEcpe:2.3:o:balluff_gmbh:BAV_MA-NC-00025-01_firmware:2.4.1:*:*:*:*:*:*:*
- Firmware 2.4.1 installed on BNI EGW-720-007-K095alle Versionenfixedballuff_psirtDEcpe:2.3:o:balluff_gmbh:BNI_EGW-720-007-K095_firmware:2.4.1:*:*:*:*:*:*:*
- Firmware <2.4.1 installed on BAV MA-NC-00025-01alle Versionenballuff_psirtDEcpe:2.3:o:balluff_gmbh:BAV_MA-NC-00025-01_firmware:*:*:*:*:*:*:*:*
- Firmware <2.4.1 installed on BNI EGW-720-007-K095alle Versionenballuff_psirtDEcpe:2.3:o:balluff_gmbh:BNI_EGW-720-007-K095_firmware:*:*:*:*:*:*:*:*
- LabX Standardalle Versionenfixedmettler_toledo_psirtCHcpe:2.3:a:mettler_toledo:labx_standard:21.4.23:*:*:*:*:*:*:*
- LabX Standardalle Versionenmettler_toledo_psirtCHcpe:2.3:a:mettler_toledo:labx_standard:21.3.22:*:*:*:*:*:*:*
Advisories (6)
Hersteller- und Ökosystem-Meldungen dazu.
- RHSA-2018:3829Red Hat Security Advisory: RHGS WA security and bug fix update2018-12-17csaf · redhat_csafUS
Updated packages are now available for Red Hat Gluster Storage 3.4 Web Administration on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2019:0019Red Hat Security Advisory: grafana security and bug fix update2019-01-03csaf · redhat_csafUS
The updated grafana package is now available for Red Hat Ceph Storage 3.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- VDE-2026-049Balluff GmbH: Multiple Vulnerabilities Affecting BNI EGW-720-007-K095 and BAV MA-NC-00025-012026-06-30csaf · balluff_psirtDE
Security advisory for Balluff BNI EGW-720-007-K095 and BAV MA-NC-00025-01 firmware versions prior to 2.4.1. This advisory covers multiple vulnerabilities affecting software components used by the device firmware.
- VDE-2026-064METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.32026-06-09csaf · mettler_toledo_psirtCH
Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases. Notice: LabX Standard was formerly known as LabX Cloud Local.
- GHSA-rgjg-66cx-5x9mGrafana Authentication Bypass2022-02-15ghsa · osvUS
Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user. ### Specific Go Packages Affected github.com/grafana/grafana/pkg/api
- GO-2022-0707Grafana Authentication Bypass in github.com/grafana/grafana2024-08-21vendor · osvUS
Grafana Authentication Bypass in github.com/grafana/grafana
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (17)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.securityfocus.com/bid/105184cnnvd
- https://access.redhat.com/errata/RHSA-2018:3829cnnvd
- https://access.redhat.com/errata/RHSA-2019:0019cnnvd
- https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.3854/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.4048.2/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.1727.2/cnnvd
- https://www.suse.com/support/update/announcement/2019/suse-su-20192671-1.htmlcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan