The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade grafana | Aug 22, 2024 | Jun 3, 2020 |
| Centos_linux | — | Upgrade grafana-postgresUpgrade grafana-mysqlUpgrade grafana-influxdbUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafanaUpgrade grafana-prometheusUpgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-debuginfoUpgrade grafana-mssqlUpgrade grafana-elasticsearchUpgrade grafana-stackdriverUpgrade grafana-graphite | Jun 23, 2020 | Jun 3, 2020 |
| Oracle_linux | — | Upgrade grafana-stackdriverUpgrade olcne-prometheus-chartUpgrade kubeletUpgrade grafana-mysqlUpgrade olcne-nginxUpgrade grafana-postgresUpgrade olcnectlUpgrade grafana-lokiUpgrade grafanaUpgrade grafana-influxdbUpgrade kubernetes-cni-pluginsUpgrade grafana-mssqlUpgrade grafana-opentsdbUpgrade olcne-agentUpgrade olcne-utilsUpgrade kubeadmUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade grafana-prometheusUpgrade grafana-elasticsearchUpgrade olcne-istio-chartUpgrade kubectlUpgrade grafana-graphiteUpgrade olcne-api-serverUpgrade kubernetes-cni | Jun 13, 2020 | Jun 3, 2020 |
| Redhat_linux | — | Upgrade grafana-lokiUpgrade grafana-prometheusUpgrade grafana-graphiteUpgrade grafana-mssqlUpgrade grafana-opentsdbUpgrade grafanaUpgrade grafana-postgresUpgrade grafana-mysqlUpgrade grafana-influxdbUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-debuginfoUpgrade grafana-cloudwatchUpgrade grafana-azure-monitor | Jun 23, 2020 | Jun 3, 2020 |
| Suse | — | Upgrade grafana-status-panelUpgrade grafana-piechart-panelUpgrade dracut-saltbootUpgrade golang-github-prometheus-node_exporterUpgrade grafana | Jun 29, 2020 | Jun 3, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub