{"id":"CVE-2023-1387","details":"Grafana is an open-source platform for monitoring and observability. \n\nStarting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. \n\nBy enabling the \"url_login\" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.","aliases":["BIT-grafana-2023-1387","GHSA-5585-m9r5-p86j"],"modified":"2026-05-18T05:56:25.021163964Z","published":"2023-04-26T13:47:16.914Z","related":["SUSE-SU-2023:2575-1","SUSE-SU-2023:2578-1","SUSE-SU-2023:2579-1","SUSE-SU-2024:0191-1","SUSE-SU-2024:0196-1","openSUSE-SU-2024:12890-1"],"database_specific":{"cna_assigner":"GRAFANA","cwe_ids":["CWE-200"],"unresolved_ranges":[{"extracted_events":[{"introduced":"9.1.0"},{"fixed":"9.2.17"},{"introduced":"9.3.0"},{"fixed":"9.3.13"},{"introduced":"9.4.0"},{"fixed":"9.5.0"},{"introduced":"9.1.0"},{"fixed":"9.2.17"},{"introduced":"9.3.0"},{"fixed":"9.3.13"},{"introduced":"9.4.0"},{"fixed":"9.5.0"}],"source":"AFFECTED_FIELD"}],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1387.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1387.json"},{"type":"ADVISORY","url":"https://github.com/grafana/bugbounty/security/advisories/GHSA-5585-m9r5-p86j"},{"type":"ADVISORY","url":"https://grafana.com/security/security-advisories/cve-2023-1387/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1387"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20230609-0003/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/grafana/grafana","events":[{"introduced":"82e32447b474565e5f815c5cfffc9d91da875f87"},{"fixed":"0588970f57b106167a4bc08f511ecb009c37e193"},{"introduced":"e9cb2a313ecc5a8e3cfeca7d2b7df2878802096e"},{"fixed":"f9f6d58de34433e1ad84bce7ab9eed6f78494b40"},{"introduced":"dbb869b17343d20a73521ada8ff61d639abe23b7"},{"fixed":"9db8aaa6b1bf2bd3ba70918db63943e08b7f3b81"}],"database_specific":{"extracted_events":[{"introduced":"9.1.0"},{"fixed":"9.2.17"},{"introduced":"9.3.0"},{"fixed":"9.3.13"},{"introduced":"9.4.0"},{"fixed":"9.4.9"}],"source":"CPE_FIELD","cpe":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-1387.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"}]}