In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-stackdriverUpgrade grafana-graphiteUpgrade grafana-elasticsearchUpgrade grafana-postgresUpgrade grafana-prometheusUpgrade grafana-cloudwatchUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafana-mssqlUpgrade grafana-azure-monitorUpgrade grafanaUpgrade grafana-mysqlUpgrade grafana-influxdb | May 4, 2022 | Apr 29, 2020 |
| Centos_linux | — | Upgrade grafana-cloudwatchUpgrade grafana-debuginfoUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-lokiUpgrade grafana-influxdbUpgrade grafana-opentsdbUpgrade grafana-stackdriverUpgrade grafana-mysqlUpgrade grafana-mssqlUpgrade grafana-azure-monitorUpgrade grafana-elasticsearchUpgrade grafana-postgresUpgrade grafana | Nov 5, 2020 | Apr 29, 2020 |
| Oracle_linux | — | Upgrade grafana-stackdriverUpgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-elasticsearchUpgrade grafana-postgresUpgrade grafana-influxdbUpgrade grafana-graphiteUpgrade grafana-mssqlUpgrade grafana-opentsdbUpgrade grafana-mysqlUpgrade grafana-prometheusUpgrade grafanaUpgrade grafana-loki | Nov 12, 2020 | Apr 23, 2020 |
| Redhat_linux | — | Upgrade grafana-graphiteUpgrade grafana-debuginfoUpgrade grafana-cloudwatchUpgrade grafana-opentsdbUpgrade grafana-mssqlUpgrade grafana-azure-monitorUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafanaUpgrade grafana-influxdbUpgrade grafana-prometheusUpgrade grafana-lokiUpgrade grafana-postgresUpgrade grafana-mysql | Nov 5, 2020 | Apr 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub