Severity
5.3
Medium severity
Details
- CVSS score
- 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CWE ID
Overview
About vulnerability
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the/api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.
Details
- Affected product:
- AlmaLinux 9.2 ESU , Alpine Linux 3.22 , Debian 12 , Debian 13 , Grafana
- Affected packages:
- grafana @ 10.4 (+16 more)
/api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.