CVE-2019-15043
HighIn Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use.
Published Sep 3, 2019 · Updated Jul 8, 2026 · Also known as SUSE-SU-2019:2906-1, UBUNTU-CVE-2019-15043
Key Facts
Patch immediately- CVE-2019-15043 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Grafana, grafana-azure-monitor (oracle), grafana-cloudwatch (oracle) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 63% probability of exploitation in the next 30 days.
- Fixed versions are available, including ansible 2.2.3.0-12.2, ansible 2.2.3.0-17.2, ansible 2.4.6.0-3.9.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
63%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2019-15043 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
Affected Products
1,314 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GrafanaGrafana | See advisory | 5.4.5 |
| grafana-azure-monitororacle | See advisory | 6.3.6-1.el8 |
| grafana-cloudwatchoracle | See advisory | 6.3.6-1.el8 |
| grafana-elasticsearchoracle | See advisory | 6.3.6-1.el8 |
| grafana-graphiteoracle | See advisory | 6.3.6-1.el8 |
Patched Releases
ansible
2.2.3.0-12.2, 2.2.3.0-17.2, 2.4.6.0-3.9.1
ansible1
1.9.6-7.3.1
ardana-ansible
8.0+git.1566374355.c509923-3.67.3, 8.0+git.1589740980.6c3bcdc-3.73.1, 9.0+git.1568821007.4e73730-3.13.3
ardana-cluster
8.0+git.1585685203.3e71e49-3.36.1
ardana-freezer
8.0+git.1586539529.b7d295f-3.21.1
ardana-glance
8.0+git.1566376789.be0fe01-3.17.3
ardana-horizon
8.0+git.1565816064.5d4f73f-3.18.3, 9.0+git.1569869028.8edfc22-3.10.3
ardana-input-model
8.0+git.1566517401.98450e6-3.33.3, 8.0+git.1589740934.0e0ad61-3.39.1
ardana-keystone
9.0+git.1570035317.78077ac-3.10.3
ardana-logging
8.0+git.1591194866.b7375d0-3.24.1
ardana-manila
8.0+git.1568835837.2452e7a-1.21.3, 9.0+git.1569444107.add6a40-3.9.3
ardana-mq
8.0+git.1589715269.62ad6df-3.22.1
ardana-neutron
8.0+git.1568220097.74ee4b4-3.33.3, 8.0+git.1590756744.ba84abc-3.42.1, 9.0+git.1571328680.3a89cb8-3.13.3, 9.0+git.1615223676.777f0b3-3.25.2
ardana-nova
8.0+git.1566902754.c58ff69-3.35.3
ardana-octavia
8.0+git.1568373448.bcaee7e-3.20.3, 8.0+git.1590100427.cf4cc8f-3.29.1
ardana-osconfig
8.0+git.1587034587.eac37b8-3.45.1
ardana-swift
9.0+git.1618235096.90974ed-3.10.2
ardana-tempest
8.0+git.1566471887.fd2fec7-3.27.3
caasp-openstack-heat-templates
1.0+git.1560518045.ad7dc6d-4.18.1
cassandra
3.11.10-3.3.3
cassandra-tools
3.11.10-3.3.3
cobbler
2.6.6-49.26.3
crowbar-core
4.0+git.1570463621.40b11cd48-9.54.1, 4.0+git.1580209654.1d112d31f-9.66.5, 4.0+git.1600767499.0615a418f-9.69.3, 5.0+git.1569597589.1f025c557-3.32.2, 5.0+git.1593156248.55bbdb26d-3.41.2, 6.0+git.1571412352.8da4d261f-3.13.3
crowbar-core-branding-upstream
4.0+git.1570463621.40b11cd48-9.54.1, 4.0+git.1580209654.1d112d31f-9.66.5, 4.0+git.1600767499.0615a418f-9.69.3, 5.0+git.1569597589.1f025c557-3.32.2, 5.0+git.1593156248.55bbdb26d-3.41.2, 6.0+git.1571412352.8da4d261f-3.13.3
crowbar-ha
4.0+git.1585316203.d6ad2c8-4.52.4, 5.0+git.1567673535.607aada-3.26.2
Timeline
Publicly disclosed
Sep 3, 2019
Last updated
Jul 8, 2026
Weakness Type
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-284 Improper Access Control
- CWE-306 Missing Authentication for Critical Function
- CWE-770 Allocation of Resources Without Limits or Throttling
References
- advisoryRHSA-2020:1659
- advisoryhttps://bugzilla.suse.com/1019074
- advisoryhttps://bugzilla.suse.com/1037777
- advisoryhttps://bugzilla.suse.com/1044849
- advisoryhttps://bugzilla.suse.com/1048688
FAQ
Common Questions.
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use.
Affected: Grafana; grafana-azure-monitor (oracle); grafana-cloudwatch (oracle), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including ansible 2.2.3.0-12.2, ansible 2.2.3.0-17.2, ansible 2.4.6.0-3.9.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2019-15043 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo