Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 13, 2018 |
| Centos_linux | — | Upgrade python-rgwUpgrade libradosstriper1Upgrade libcephfs2Upgrade ceph-selinuxUpgrade ceph-baseUpgrade librgw2Upgrade ceph-ansibleUpgrade grafanaUpgrade librgw2-develUpgrade ceph-radosgwUpgrade librados-develUpgrade librbd-develUpgrade ceph-debuginfoUpgrade rbd-mirrorUpgrade ceph-fuseUpgrade python-cephfsUpgrade librgw-develUpgrade ceph-commonUpgrade libcephfs1-develUpgrade libcephfs-develUpgrade ceph-mdsUpgrade libcephfs1 | Aug 28, 2019 | Dec 13, 2018 |
| Redhat_linux | — | Upgrade grafanaUpgrade libcephfs1-develUpgrade libcephfs-develUpgrade librgw2-develUpgrade ceph-commonUpgrade librados-develUpgrade libcephfs2Upgrade librgw-develUpgrade ceph-baseUpgrade libcephfs1Upgrade python-cephfsUpgrade librbd-develUpgrade librgw2Upgrade ceph-ansibleUpgrade rbd-mirrorUpgrade python-rgwUpgrade libradosstriper1Upgrade ceph-fuseUpgrade ceph-selinuxUpgrade ceph-mdsUpgrade ceph-radosgwUpgrade ceph-debuginfo | Apr 15, 2019 | Dec 13, 2018 |
| Suse | — | Upgrade grafana | Feb 4, 2022 | Dec 13, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub