{"id":"CVE-2018-15727","details":"Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid \"remember me\" cookie knowing only a username of an LDAP or OAuth user.","aliases":["GHSA-rgjg-66cx-5x9m","GO-2022-0707"],"modified":"2026-03-15T15:01:53.271316Z","published":"2018-08-29T15:29:00.240Z","related":["SUSE-SU-2019:2671-1","SUSE-SU-2019:2867-1","SUSE-SU-2020:1273-1"],"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/105184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3829"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:0019"},{"type":"FIX","url":"https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/grafana/grafana","events":[{"introduced":"91431655808cd10acf7df4c9af702d95644cbda8"},{"fixed":"1ad5b02166a18962f862f7b776771eedfef17aba"},{"introduced":"af6e28366bf3413ee3af56c540513dd70f467c41"},{"fixed":"cf4c090fe2e895fffbc319f4dd025d8c85103656"}],"database_specific":{"versions":[{"introduced":"4.0.0"},{"fixed":"4.6.4"},{"introduced":"5.0.0"},{"fixed":"5.2.3"}]}}],"versions":["v4.0.0","v4.0.1","v4.0.2","v4.1.0-beta1","v4.2.0-beta1","v4.3.0","v4.3.0-beta1","v4.3.1","v4.3.2","v4.4.0","v4.4.1","v4.4.2","v4.4.3","v4.5.0","v4.5.0-beta1","v4.5.1","v4.6.0","v4.6.0-beta1","v4.6.0-beta2","v4.6.0-beta3","v4.6.1","v4.6.2","v4.6.3","v5.0.0","v5.0.0-beta1","v5.0.0-beta2","v5.0.0-beta3","v5.0.0-beta4","v5.0.0-beta5","v5.2.0","v5.2.0-beta1","v5.2.0-beta2","v5.2.0-beta3","v5.2.1","v5.2.2"],"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"2.0.0"},{"last_affected":"2.1.2"}]},{"events":[{"introduced":"3.0.0"},{"last_affected":"3.1.1"}]},{"events":[{"introduced":"0"},{"last_affected":"3.0"}]}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-15727.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}