In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-graphiteUpgrade grafana-mysqlUpgrade grafana-prometheusUpgrade grafana-mssqlUpgrade grafana-cloudwatchUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafana-influxdbUpgrade grafanaUpgrade grafana-azure-monitorUpgrade grafana-postgres | May 4, 2022 | Apr 29, 2020 |
| Centos_linux | — | Upgrade grafana-prometheusUpgrade grafana-opentsdbUpgrade grafana-cloudwatchUpgrade grafana-debuginfoUpgrade grafana-graphiteUpgrade grafana-influxdbUpgrade grafana-lokiUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-azure-monitorUpgrade grafana-mysqlUpgrade grafana-mssqlUpgrade grafana-postgresUpgrade grafana | Nov 5, 2020 | Apr 29, 2020 |
| Oracle_linux | — | Upgrade grafana-mysqlUpgrade grafana-opentsdbUpgrade grafana-mssqlUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-lokiUpgrade grafanaUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-azure-monitorUpgrade grafana-cloudwatch | Nov 12, 2020 | Apr 23, 2020 |
| Redhat_linux | — | Upgrade grafana-prometheusUpgrade grafana-influxdbUpgrade grafana-stackdriverUpgrade grafanaUpgrade grafana-mysqlUpgrade grafana-lokiUpgrade grafana-postgresUpgrade grafana-elasticsearchUpgrade grafana-opentsdbUpgrade grafana-debuginfoUpgrade grafana-mssqlUpgrade grafana-graphiteUpgrade grafana-cloudwatchUpgrade grafana-azure-monitor | Nov 5, 2020 | Apr 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub