.. / CVE-2022-26148

• Info Disclosure
• Nuclei
• Web

Exploit for Grafana & Zabbix Integration - Credentials Disclosure (CVE-2022-26148)

Description:

Grafana through 7.3.4, when integrated with Zabbix, contains a credential disclosure vulnerability. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.

Nuclei Template

View the template here CVE-2022-26148.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-26148.yaml

References: