In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-mssqlUpgrade grafana-prometheusUpgrade grafana-mysqlUpgrade grafana-azure-monitorUpgrade grafanaUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafana-cloudwatchUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafana-graphiteUpgrade grafana-elasticsearchUpgrade grafana-stackdriver | May 4, 2022 | Apr 29, 2020 |
| Centos_linux | — | Upgrade grafana-cloudwatchUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafana-prometheusUpgrade grafana-influxdbUpgrade grafana-debuginfoUpgrade grafana-graphiteUpgrade grafana-postgresUpgrade grafana-mysqlUpgrade grafana-mssqlUpgrade grafana-stackdriverUpgrade grafana-azure-monitorUpgrade grafanaUpgrade grafana-elasticsearch | Nov 5, 2020 | Apr 29, 2020 |
| Oracle_linux | — | Upgrade grafana-mssqlUpgrade grafana-postgresUpgrade grafana-graphiteUpgrade grafana-mysqlUpgrade grafana-opentsdbUpgrade grafana-prometheusUpgrade grafanaUpgrade grafana-lokiUpgrade grafana-influxdbUpgrade grafana-cloudwatchUpgrade grafana-elasticsearchUpgrade grafana-azure-monitorUpgrade grafana-stackdriver | Nov 12, 2020 | Apr 23, 2020 |
| Redhat_linux | — | Upgrade grafana-graphiteUpgrade grafana-debuginfoUpgrade grafana-mssqlUpgrade grafana-opentsdbUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade grafana-elasticsearchUpgrade grafanaUpgrade grafana-stackdriverUpgrade grafana-lokiUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafana-prometheusUpgrade grafana-mysql | Nov 5, 2020 | Apr 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub