An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-mssqlUpgrade grafana-mysqlUpgrade grafana-postgresUpgrade grafana-lokiUpgrade grafanaUpgrade grafana-graphiteUpgrade grafana-opentsdbUpgrade grafana-prometheusUpgrade grafana-influxdbUpgrade grafana-azure-monitorUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-cloudwatch | May 4, 2022 | Apr 29, 2020 |
| Centos_linux | — | Upgrade grafana-graphiteUpgrade grafana-mysqlUpgrade grafana-stackdriverUpgrade grafana-debuginfoUpgrade grafana-postgresUpgrade grafana-influxdbUpgrade grafana-cloudwatchUpgrade grafana-mssqlUpgrade grafana-azure-monitorUpgrade grafana-prometheusUpgrade grafanaUpgrade grafana-lokiUpgrade grafana-elasticsearchUpgrade grafana-opentsdb | Nov 5, 2020 | Apr 29, 2020 |
| Oracle_linux | — | Upgrade grafana-elasticsearchUpgrade grafana-prometheusUpgrade grafana-opentsdbUpgrade grafana-cloudwatchUpgrade grafana-mysqlUpgrade grafana-postgresUpgrade grafana-graphiteUpgrade grafana-azure-monitorUpgrade grafanaUpgrade grafana-stackdriverUpgrade grafana-lokiUpgrade grafana-mssqlUpgrade grafana-influxdb | Nov 12, 2020 | Apr 23, 2020 |
| Redhat_linux | — | Upgrade grafana-mysqlUpgrade grafana-lokiUpgrade grafana-mssqlUpgrade grafana-elasticsearchUpgrade grafana-postgresUpgrade grafana-stackdriverUpgrade grafanaUpgrade grafana-cloudwatchUpgrade grafana-opentsdbUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-debuginfoUpgrade grafana-azure-monitorUpgrade grafana-influxdb | Nov 5, 2020 | Apr 29, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub