CVE-2022-26148
Published: 21 March 2022
Summary
CVE-2022-26148 is a critical-severity Cleartext Storage of Sensitive Information (CWE-312) vulnerability in Redhat Ceph Storage. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-26148 affects Grafana versions through 7.3.4 when integrated with Zabbix. The vulnerability stems from exposure of the Zabbix account password and URL address directly in the api_jsonrpc.php HTML source code, classified under CWE-312 as cleartext storage of sensitive information.
An unauthenticated remote attacker can exploit the flaw by logging in or registering a user account, then inspecting the page source and searching for the password string. Successful exploitation grants access to the Zabbix credentials, enabling full compromise of the linked Zabbix instance and any connected data or systems, consistent with the CVSS 9.8 rating reflecting network-accessible attack with no required privileges or user interaction.
Public references include NetApp security advisories and technical write-ups at 2k8.org that document the exposure and recommend reviewing integration configurations.
The CVE carries a high exploitation probability with an EPSS score currently at 0.8722 and a peak of 0.9032.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30715
Vulnerability details
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to…
more
view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Training on secure data handling discourages cleartext storage of sensitive information.
Data action mapping can detect storage actions that leave sensitive information in cleartext.
Configuration policies can mandate secure storage methods to avoid cleartext storage of sensitive information.
Policy requires protection measures such as encryption for sensitive data stored on media, preventing cleartext exposure.
Key-management policy requires protected storage of key material, preventing cleartext storage of sensitive cryptographic keys.
Requiring confidentiality protection for information at rest eliminates cleartext storage of sensitive data on persistent media.
Reduces cleartext storage of sensitive data when OPSEC identifies and mandates protection of key information artifacts.