Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/grafana/synthetic-monitoring-agent

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9GoPublished

    Default installation of synthetic-monitoring-agent exposes sensitive information

    CVE-2022-46156 · GHSA-9j4f-f249-q5w8

    Affected
    • Go github.com/grafana/synthetic-monitoring-agent < 0.12.0
    Fixed in
    0.12.0· Vendor fix available
    Issue
    Impact Users running the Synthetic Monitoring agent in their local network are impacted. The authentication token used to communicate with the Synthetic Monitoring API is exposed thru a debugging endpoint. This token can be used to retrieve the Synthetic Monitoring checks created by the user and assigned to the agent identified with that token. The Synthetic Monitoring API will reject connections from already-connected agents, so access to the token does not guarantee access to the checks. Patches Fixed version is v0.12.0 Users are advised to rotate the agent tokens. After upgrading to version v0.12.0 or later, it's recommended that user's of distribution packages (e.g. Debian or RedHat and their derivatives) review the configuration stored in /etc/synthetic-monitoring/synthetic-monitoring-agent.conf, specifically the APITOKEN variable which has been renamed to SMAGENTAPITOKEN. Workarounds With all previous versions, it's recommended that users review the agent settings and set the…

    Recommended action: Upgrade to 0.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →