In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-graphiteUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-azure-monitorUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafana-lokiUpgrade grafana-mssqlUpgrade grafana-opentsdbUpgrade grafana-prometheusUpgrade grafana-mysqlUpgrade grafanaUpgrade grafana-cloudwatch | May 4, 2022 | Apr 29, 2020 |
| Centos_linux | — | Upgrade grafana-opentsdbUpgrade grafana-graphiteUpgrade grafana-cloudwatchUpgrade grafana-prometheusUpgrade grafana-debuginfoUpgrade grafana-influxdbUpgrade grafana-lokiUpgrade grafana-postgresUpgrade grafanaUpgrade grafana-mysqlUpgrade grafana-mssqlUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-azure-monitor | Nov 5, 2020 | Apr 29, 2020 |
| Oracle_linux | — | Upgrade grafana-stackdriverUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade grafana-elasticsearchUpgrade grafana-prometheusUpgrade grafana-postgresUpgrade grafana-graphiteUpgrade grafana-mssqlUpgrade grafana-influxdbUpgrade grafana-lokiUpgrade grafanaUpgrade grafana-mysqlUpgrade grafana-opentsdb | Nov 12, 2020 | Apr 23, 2020 |
| Redhat_linux | — | Upgrade grafana-elasticsearchUpgrade grafana-lokiUpgrade grafana-mysqlUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafanaUpgrade grafana-stackdriverUpgrade grafana-prometheusUpgrade grafana-graphiteUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade grafana-mssqlUpgrade grafana-opentsdbUpgrade grafana-debuginfo | Nov 5, 2020 | Apr 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub