CVE-2018-15727 is a critical authentication bypass vulnerability affecting Grafana versions 2.x, 3.x, and 4.x before 4.6.4, and 5.x before 5.2.3, as well as Red Hat Ceph Storage and Grafana distributions. An attacker can generate a valid "remember me" cookie for LDAP or OAuth users, gaining unauthorized access. This vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a network-exploitable flaw with low attack complexity, requiring no user interaction, and leading to complete compromise of confidentiality, integrity, and availability. Its high EPSS score and FAUCET Risk Score of 99/100 further emphasize its significant risk. While not listed on the CISA KEV catalog or currently active on the Hot List, exploit modules are available in Metasploit, confirming its exploitability. Despite this, there is minimal community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.0.0, <= 2.1.2CPE matchmatch criteria | cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | ||
>= 3.0.0, <= 3.1.1CPE matchmatch criteria | cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | ||
>= 4.0.0, < 4.6.4CPE matchmatch criteria | cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | ||
>= 5.0.0, < 5.2.3CPE matchmatch criteria | cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | ||
3.0CPE matchmatch criteria | cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.