In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-graphiteUpgrade grafana-azure-monitorUpgrade grafanaUpgrade grafana-postgresUpgrade grafana-opentsdbUpgrade grafana-lokiUpgrade grafana-influxdbUpgrade grafana-prometheusUpgrade grafana-mssqlUpgrade grafana-cloudwatchUpgrade grafana-mysql | May 4, 2022 | Apr 29, 2020 |
| Centos_linux | — | Upgrade grafana-lokiUpgrade grafana-prometheusUpgrade grafana-graphiteUpgrade grafana-opentsdbUpgrade grafana-debuginfoUpgrade grafana-influxdbUpgrade grafana-cloudwatchUpgrade grafana-mssqlUpgrade grafana-stackdriverUpgrade grafanaUpgrade grafana-elasticsearchUpgrade grafana-postgresUpgrade grafana-azure-monitorUpgrade grafana-mysql | Nov 5, 2020 | Apr 29, 2020 |
| Oracle_linux | — | Upgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-influxdbUpgrade grafana-mysqlUpgrade grafana-lokiUpgrade grafanaUpgrade grafana-graphiteUpgrade grafana-mssqlUpgrade grafana-postgresUpgrade grafana-prometheusUpgrade grafana-opentsdb | Nov 12, 2020 | Apr 23, 2020 |
| Redhat_linux | — | Upgrade grafana-opentsdbUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade grafana-debuginfoUpgrade grafana-mssqlUpgrade grafana-graphiteUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-lokiUpgrade grafana-postgresUpgrade grafana-prometheusUpgrade grafana-influxdbUpgrade grafanaUpgrade grafana-mysql | Nov 5, 2020 | Apr 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub