Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins
概要
Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
参照URL
- advisory github.com
- advisory github.com
- advisory github.com
- advisory github.com
- web nvd.nist.gov