Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-opentsdbUpgrade grafana-graphiteUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafana-lokiUpgrade grafana-prometheusUpgrade grafana-azure-monitorUpgrade grafana-mssqlUpgrade grafana-elasticsearchUpgrade grafana-mysqlUpgrade grafanaUpgrade grafana-cloudwatchUpgrade grafana-stackdriver | May 4, 2022 | Aug 28, 2020 |
| Centos_linux | — | Upgrade grafana-azure-monitorUpgrade grafana-mssqlUpgrade grafana-elasticsearchUpgrade grafanaUpgrade grafana-influxdbUpgrade grafana-lokiUpgrade grafana-graphiteUpgrade grafana-opentsdbUpgrade grafana-debuginfoUpgrade grafana-mysqlUpgrade grafana-prometheusUpgrade grafana-cloudwatchUpgrade grafana-postgresUpgrade grafana-stackdriver | Nov 5, 2020 | Aug 28, 2020 |
| Oracle_linux | — | Upgrade grafana-mysqlUpgrade grafana-postgresUpgrade grafana-stackdriverUpgrade grafana-lokiUpgrade grafanaUpgrade grafana-influxdbUpgrade grafana-mssqlUpgrade grafana-opentsdbUpgrade grafana-azure-monitorUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-cloudwatchUpgrade grafana-elasticsearch | Nov 12, 2020 | Aug 27, 2020 |
| Redhat_linux | — | Upgrade grafana-postgresUpgrade grafana-mysqlUpgrade grafana-prometheusUpgrade grafana-debuginfoUpgrade grafanaUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafana-influxdbUpgrade grafana-graphiteUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade grafana-mssqlUpgrade grafana-elasticsearchUpgrade grafana-stackdriver | Nov 5, 2020 | Aug 28, 2020 |
| Suse | — | Upgrade system-user-grafana | Jun 9, 2021 | Aug 28, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Aug 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub