Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-prometheusUpgrade grafana-lokiUpgrade grafana-graphiteUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafana-opentsdbUpgrade grafana-cloudwatchUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafanaUpgrade grafana-mysqlUpgrade grafana-azure-monitorUpgrade grafana-mssql | May 4, 2022 | Aug 28, 2020 |
| Centos_linux | — | Upgrade grafana-postgresUpgrade grafana-stackdriverUpgrade grafana-opentsdbUpgrade grafana-elasticsearchUpgrade grafana-graphiteUpgrade grafana-azure-monitorUpgrade grafana-mssqlUpgrade grafana-lokiUpgrade grafana-prometheusUpgrade grafana-cloudwatchUpgrade grafana-mysqlUpgrade grafanaUpgrade grafana-debuginfoUpgrade grafana-influxdb | Nov 5, 2020 | Aug 28, 2020 |
| Oracle_linux | — | Upgrade grafana-postgresUpgrade grafana-stackdriverUpgrade grafanaUpgrade grafana-lokiUpgrade grafana-mysqlUpgrade grafana-influxdbUpgrade grafana-opentsdbUpgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-prometheusUpgrade grafana-elasticsearchUpgrade grafana-mssqlUpgrade grafana-graphite | Nov 12, 2020 | Aug 27, 2020 |
| Redhat_linux | — | Upgrade grafana-mssqlUpgrade grafana-stackdriverUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade grafana-elasticsearchUpgrade grafana-prometheusUpgrade grafana-postgresUpgrade grafana-debuginfoUpgrade grafana-opentsdbUpgrade grafana-lokiUpgrade grafana-mysqlUpgrade grafana-graphiteUpgrade grafanaUpgrade grafana-influxdb | Nov 5, 2020 | Aug 28, 2020 |
| Suse | — | Upgrade system-user-grafana | Jun 9, 2021 | Aug 28, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Aug 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub