CVE-2019-15635

An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, the password for the data source is revealed and sent to the server. From a browser, a prompt to save the credentials is generated, and the password can be revealed by simply checking the "Show password" box.

• CWE-319
• CWE-522

• https://exchange.xforce.ibmcloud.com/vulnerabilities/167244Third Party Advisory, VDB Entry
• https://security.netapp.com/advisory/ntap-20191009-0002/Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/167244Third Party Advisory, VDB Entry
• https://security.netapp.com/advisory/ntap-20191009-0002/Third Party Advisory

Published

Sep 23, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15627Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Securit…7.1
• CVE-2019-15628Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) …7.8
• CVE-2019-15629Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for …7.5
• CVE-2019-1563In situations where an attacker receives automated notificat…3.7
• CVE-2019-15630Directory Traversal in APIkit, HTTP connector, and OAuth2 Pr…
• CVE-2019-15631Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3…9.8
• CVE-2019-15637Numerous Tableau products are vulnerable to XXE via a malici…8.1
• CVE-2019-15638COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontro…7.8
• CVE-2019-15639main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allo…7.5
• CVE-2019-1564Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15640Limesurvey before 3.17.10 does not validate both the MIME ty…
• CVE-2019-15641xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE …