An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-postgresUpgrade grafana-prometheusUpgrade grafana-graphiteUpgrade grafana-lokiUpgrade grafana-influxdbUpgrade grafana-opentsdbUpgrade grafanaUpgrade grafana-mssqlUpgrade grafana-mysql | May 4, 2022 | Apr 29, 2020 |
| Centos_linux | — | Upgrade grafana-elasticsearchUpgrade grafanaUpgrade grafana-influxdbUpgrade grafana-azure-monitorUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafana-prometheusUpgrade grafana-cloudwatchUpgrade grafana-mssqlUpgrade grafana-debuginfoUpgrade grafana-mysqlUpgrade grafana-graphiteUpgrade grafana-postgresUpgrade grafana-stackdriver | Nov 5, 2020 | Apr 29, 2020 |
| Oracle_linux | — | Upgrade grafana-azure-monitorUpgrade grafana-lokiUpgrade grafana-influxdbUpgrade grafana-mssqlUpgrade grafanaUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-mysqlUpgrade grafana-postgresUpgrade grafana-cloudwatchUpgrade grafana-opentsdb | Nov 12, 2020 | Apr 23, 2020 |
| Redhat_linux | — | Upgrade grafana-postgresUpgrade grafana-stackdriverUpgrade grafana-cloudwatchUpgrade grafana-elasticsearchUpgrade grafana-mysqlUpgrade grafana-lokiUpgrade grafana-mssqlUpgrade grafanaUpgrade grafana-debuginfoUpgrade grafana-opentsdbUpgrade grafana-prometheusUpgrade grafana-influxdbUpgrade grafana-azure-monitorUpgrade grafana-graphite | Nov 5, 2020 | Apr 29, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub