Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-postgresUpgrade grafana-prometheusUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafana-graphiteUpgrade grafana-influxdbUpgrade grafana-cloudwatchUpgrade grafana-mysqlUpgrade grafanaUpgrade grafana-elasticsearchUpgrade grafana-stackdriverUpgrade grafana-mssqlUpgrade grafana-azure-monitor | May 4, 2022 | Aug 28, 2020 |
| Centos_linux | — | Upgrade grafana-stackdriverUpgrade grafana-postgresUpgrade grafana-azure-monitorUpgrade grafanaUpgrade grafana-influxdbUpgrade grafana-elasticsearchUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafana-debuginfoUpgrade grafana-prometheusUpgrade grafana-cloudwatchUpgrade grafana-mssqlUpgrade grafana-mysqlUpgrade grafana-graphite | Nov 5, 2020 | Aug 28, 2020 |
| Oracle_linux | — | Upgrade grafana-elasticsearchUpgrade grafana-mssqlUpgrade grafana-graphiteUpgrade grafana-cloudwatchUpgrade grafana-prometheusUpgrade grafana-opentsdbUpgrade grafana-azure-monitorUpgrade grafana-mysqlUpgrade grafana-lokiUpgrade grafana-stackdriverUpgrade grafanaUpgrade grafana-influxdbUpgrade grafana-postgres | Nov 12, 2020 | Aug 27, 2020 |
| Redhat_linux | — | Upgrade grafanaUpgrade grafana-influxdbUpgrade grafana-debuginfoUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-postgresUpgrade grafana-mysqlUpgrade grafana-opentsdbUpgrade grafana-lokiUpgrade grafana-elasticsearchUpgrade grafana-mssqlUpgrade grafana-azure-monitorUpgrade grafana-stackdriverUpgrade grafana-cloudwatch | Nov 5, 2020 | Aug 28, 2020 |
| Suse | — | Upgrade system-user-grafana | Jun 9, 2021 | Aug 28, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Aug 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub