The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade grafana | Aug 22, 2024 | Jun 3, 2020 |
| Centos_linux | — | Upgrade grafana-opentsdbUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafana-prometheusUpgrade grafana-lokiUpgrade grafanaUpgrade grafana-mysqlUpgrade grafana-mssqlUpgrade grafana-elasticsearchUpgrade grafana-debuginfoUpgrade grafana-azure-monitorUpgrade grafana-graphiteUpgrade grafana-cloudwatchUpgrade grafana-stackdriver | Jun 23, 2020 | Jun 3, 2020 |
| Oracle_linux | — | Upgrade grafana-graphiteUpgrade olcne-istio-chartUpgrade grafana-cloudwatchUpgrade grafana-opentsdbUpgrade olcne-agentUpgrade kubeadmUpgrade kubectlUpgrade kubernetes-cniUpgrade grafana-azure-monitorUpgrade olcne-api-serverUpgrade olcne-utilsUpgrade grafana-mssqlUpgrade grafana-elasticsearchUpgrade grafana-prometheusUpgrade grafana-postgresUpgrade grafana-mysqlUpgrade grafana-influxdbUpgrade grafana-stackdriverUpgrade kubernetes-cni-pluginsUpgrade olcne-nginxUpgrade olcnectlUpgrade grafanaUpgrade kubeletUpgrade olcne-prometheus-chartUpgrade grafana-loki | Jun 13, 2020 | Jun 3, 2020 |
| Redhat_linux | — | Upgrade grafana-debuginfoUpgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafanaUpgrade grafana-mssqlUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-mysql | Jun 23, 2020 | Jun 3, 2020 |
| Suse | — | Upgrade grafana-status-panelUpgrade dracut-saltbootUpgrade grafana-piechart-panelUpgrade golang-github-prometheus-node_exporterUpgrade grafana | Jun 29, 2020 | Jun 3, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub