Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-azure-monitorUpgrade grafanaUpgrade grafana-elasticsearchUpgrade grafana-mssqlUpgrade grafana-cloudwatchUpgrade grafana-mysqlUpgrade grafana-stackdriverUpgrade grafana-postgresUpgrade grafana-graphiteUpgrade grafana-influxdbUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafana-prometheus | May 4, 2022 | Aug 28, 2020 |
| Centos_linux | — | Upgrade grafana-opentsdbUpgrade grafana-lokiUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-influxdbUpgrade grafana-cloudwatchUpgrade grafanaUpgrade grafana-debuginfoUpgrade grafana-mssqlUpgrade grafana-mysqlUpgrade grafana-azure-monitorUpgrade grafana-elasticsearchUpgrade grafana-stackdriverUpgrade grafana-postgres | Nov 5, 2020 | Aug 28, 2020 |
| Oracle_linux | — | Upgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-opentsdbUpgrade grafana-mssqlUpgrade grafana-elasticsearchUpgrade grafana-lokiUpgrade grafana-mysqlUpgrade grafana-influxdbUpgrade grafana-stackdriverUpgrade grafanaUpgrade grafana-postgres | Nov 12, 2020 | Aug 27, 2020 |
| Redhat_linux | — | Upgrade grafana-elasticsearchUpgrade grafana-cloudwatchUpgrade grafana-mssqlUpgrade grafana-stackdriverUpgrade grafana-azure-monitorUpgrade grafana-mysqlUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-postgresUpgrade grafanaUpgrade grafana-debuginfoUpgrade grafana-influxdbUpgrade grafana-opentsdbUpgrade grafana-loki | Nov 5, 2020 | Aug 28, 2020 |
| Suse | — | Upgrade system-user-grafana | Jun 9, 2021 | Aug 28, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Aug 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub