Exposure · Scan · first seen 1 Oct
MediumLikelyIn progressTunde Martinsfix by 30 Nov
In progress · with Tunde
Nothing's blocking it. It closes when the check that found it stops seeing it.
One problem in one place, found by scan.
1 source · 1 place
Scan
First found Thu 1 Oct, last seen Mon 12 Oct
What closes it
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
33rd of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
34 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The scan's case file · tessellatepay.com
See it in that scanWhy it matters here
Anyone can try passwords on your monitoring. Grafana holds data source credentials and production metrics.
What we saw
A Grafana sign-in page answers to anyone. Dashboards often hold production metrics and data source credentials.
https://metrics.tessellatepay.comGrafana v10.2.2 (6c3ae2b7)
The fix
Put Grafana behind your SSO or VPN, or allow only office addresses.
Where
What happened, and what was said
1 event · 0 comments · oldest first
One finding belongs with this one
The same story from another source: fix them together