The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade grafana | Aug 22, 2024 | Jun 3, 2020 |
| Centos_linux | — | Upgrade grafana-opentsdbUpgrade grafana-postgresUpgrade grafana-prometheusUpgrade grafana-lokiUpgrade grafana-influxdbUpgrade grafanaUpgrade grafana-mysqlUpgrade grafana-cloudwatchUpgrade grafana-graphiteUpgrade grafana-debuginfoUpgrade grafana-mssqlUpgrade grafana-elasticsearchUpgrade grafana-azure-monitorUpgrade grafana-stackdriver | Jun 23, 2020 | Jun 3, 2020 |
| Oracle_linux | — | Upgrade olcne-utilsUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade kubeadmUpgrade kubernetes-cniUpgrade olcne-api-serverUpgrade grafana-opentsdbUpgrade grafana-prometheusUpgrade grafana-graphiteUpgrade grafana-mssqlUpgrade olcne-istio-chartUpgrade grafana-elasticsearchUpgrade olcne-agentUpgrade kubectlUpgrade kubeletUpgrade grafana-mysqlUpgrade olcnectlUpgrade kubernetes-cni-pluginsUpgrade grafana-influxdbUpgrade grafana-stackdriverUpgrade grafanaUpgrade olcne-nginxUpgrade grafana-postgresUpgrade olcne-prometheus-chartUpgrade grafana-loki | Jun 13, 2020 | Jun 3, 2020 |
| Redhat_linux | — | Upgrade grafana-mssqlUpgrade grafanaUpgrade grafana-influxdbUpgrade grafana-mysqlUpgrade grafana-lokiUpgrade grafana-postgresUpgrade grafana-opentsdbUpgrade grafana-prometheusUpgrade grafana-graphiteUpgrade grafana-stackdriverUpgrade grafana-cloudwatchUpgrade grafana-debuginfoUpgrade grafana-azure-monitorUpgrade grafana-elasticsearch | Jun 23, 2020 | Jun 3, 2020 |
| Suse | — | Upgrade grafanaUpgrade grafana-piechart-panelUpgrade golang-github-prometheus-node_exporterUpgrade grafana-status-panelUpgrade dracut-saltboot | Jun 29, 2020 | Jun 3, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub