An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-elasticsearchUpgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-stackdriverUpgrade grafanaUpgrade grafana-mysqlUpgrade grafana-mssqlUpgrade grafana-influxdbUpgrade grafana-opentsdbUpgrade grafana-graphiteUpgrade grafana-lokiUpgrade grafana-postgresUpgrade grafana-prometheus | May 4, 2022 | Apr 29, 2020 |
| Centos_linux | — | Upgrade grafana-debuginfoUpgrade grafana-graphiteUpgrade grafana-postgresUpgrade grafana-stackdriverUpgrade grafana-mysqlUpgrade grafanaUpgrade grafana-elasticsearchUpgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-mssqlUpgrade grafana-influxdbUpgrade grafana-opentsdbUpgrade grafana-prometheusUpgrade grafana-loki | Nov 5, 2020 | Apr 29, 2020 |
| Oracle_linux | — | Upgrade grafana-graphiteUpgrade grafana-cloudwatchUpgrade grafana-opentsdbUpgrade grafana-postgresUpgrade grafana-prometheusUpgrade grafana-elasticsearchUpgrade grafana-mysqlUpgrade grafanaUpgrade grafana-stackdriverUpgrade grafana-mssqlUpgrade grafana-lokiUpgrade grafana-influxdbUpgrade grafana-azure-monitor | Nov 12, 2020 | Apr 23, 2020 |
| Redhat_linux | — | Upgrade grafana-postgresUpgrade grafana-lokiUpgrade grafana-elasticsearchUpgrade grafana-mssqlUpgrade grafana-cloudwatchUpgrade grafana-stackdriverUpgrade grafana-mysqlUpgrade grafanaUpgrade grafana-influxdbUpgrade grafana-debuginfoUpgrade grafana-graphiteUpgrade grafana-opentsdbUpgrade grafana-azure-monitorUpgrade grafana-prometheus | Nov 5, 2020 | Apr 29, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub