Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 13, 2018 |
| Centos_linux | — | Upgrade python-rgwUpgrade grafanaUpgrade librgw2Upgrade ceph-baseUpgrade libradosstriper1Upgrade ceph-selinuxUpgrade ceph-ansibleUpgrade libcephfs2Upgrade ceph-radosgwUpgrade librados-develUpgrade libcephfs1Upgrade libcephfs1-develUpgrade librgw2-develUpgrade librgw-develUpgrade libcephfs-develUpgrade ceph-mdsUpgrade ceph-fuseUpgrade rbd-mirrorUpgrade python-cephfsUpgrade librbd-develUpgrade ceph-commonUpgrade ceph-debuginfo | Aug 28, 2019 | Dec 13, 2018 |
| Redhat_linux | — | Upgrade grafanaUpgrade librgw-develUpgrade libcephfs1Upgrade libcephfs2Upgrade ceph-baseUpgrade librados-develUpgrade librgw2-develUpgrade libcephfs1-develUpgrade libcephfs-develUpgrade ceph-commonUpgrade python-rgwUpgrade libradosstriper1Upgrade ceph-mdsUpgrade ceph-fuseUpgrade rbd-mirrorUpgrade python-cephfsUpgrade ceph-ansibleUpgrade librgw2Upgrade ceph-radosgwUpgrade ceph-selinuxUpgrade librbd-develUpgrade ceph-debuginfo | Apr 15, 2019 | Dec 13, 2018 |
| Suse | — | Upgrade grafana | Feb 4, 2022 | Dec 13, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub