Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2020-13379
HistoryJun 03, 2020 - 7:15 p.m.

CVE-2020-13379

2020-06-0319:15:10
CWE-918
mitre
web.nvd.nist.gov
268
In Wild
9
cve-2020-13379
grafana
ssrf
incorrect access control
nvd
security vulnerability
segfault
dos

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

AI Score

8.1

Confidence

High

EPSS

0.717

Percentile

98.1%

JSON

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS’ing Grafana via SegFault.

Affected configurations

Nvd
Node
grafanagrafanaRange3.0.1–7.0.1
Node
fedoraprojectfedoraMatch31
OR
fedoraprojectfedoraMatch32
Node
netappe-series_performance_analyzerMatch-
Node
opensuseleapMatch15.2
Node
opensusebackports_sleMatch15.0sp1
OR
opensusebackports_sleMatch15.0sp2
VendorProductVersionCPE
grafanagrafana*cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
fedoraprojectfedora31cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
fedoraprojectfedora32cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
netappe-series_performance_analyzer-cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*
opensuseleap15.2cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
opensusebackports_sle15.0cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
opensusebackports_sle15.0cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*

References

Social References

More

Related

osv 4
nessus 14
packetstorm 1
avleonov 1
redhat 8
oraclelinux 3
zdt 1
prion 1
veracode 1
github 1
altlinux 2
redhatcve 1
ubuntucve 1
cvelist 1
nuclei 1
nvd 1
exploitdb 1
alpinelinux 1
attackerkb 1
openvas 6
suse 4
fedora 2
osv
osv
CVE-2020-13379
2020-06-03 19:15:10
BIT-grafana-2020-13379
2024-03-06 11:01:01
Server Side Request Forgery in Grafana
2022-02-15 01:57:18
nessus
nessus
CentOS 8 : grafana (CESA-2020:2641)
2021-02-01 00:00:00
Oracle Linux 8 : grafana (ELSA-2020-2641)
2020-06-24 00:00:00
Fedora 31 : grafana (2020-e6e81a03d6)
2020-06-17 00:00:00
packetstorm
packetstorm
Grafana 7.0.1 Denial Of Service
2020-07-06 00:00:00
avleonov
avleonov
How to list, create, update and delete Grafana dashboards via API
2020-06-10 00:46:05
redhat
redhat
(RHSA-2020:2641) Important: grafana security update
2020-06-22 06:50:20
(RHSA-2020:2676) Important: grafana security update
2020-06-23 12:35:52
(RHSA-2020:2792) Moderate: OpenShift Container Platform 4.4.11 grafana-container security update
2020-07-06 20:05:13
oraclelinux
oraclelinux
grafana security update
2020-06-22 00:00:00
grafana kubernetes-cni kubernetes-cni-plugins kubernetes kubernetes olcne security update
2020-06-12 00:00:00
grafana security, bug fix, and enhancement update
2020-11-10 00:00:00
zdt
zdt
Grafana 7.0.1 - Denial of Service Exploit
2020-07-07 00:00:00
prion
prion
Design/Logic Flaw
2020-06-03 19:15:00
veracode
veracode
Server-Side Request Forgery (SSRF)
2020-06-04 04:20:58
github
github
Server Side Request Forgery in Grafana
2022-02-15 01:57:18
altlinux
altlinux
Security fix for the ALT Linux 9 package grafana version 7.0.3-alt1
2020-06-04 00:00:00
Security fix for the ALT Linux 10 package grafana version 7.0.3-alt1
2020-06-04 00:00:00
redhatcve
redhatcve
CVE-2020-13379
2020-06-03 17:21:50
ubuntucve
ubuntucve
CVE-2020-13379
2020-06-03 00:00:00
cvelist
cvelist
CVE-2020-13379
2020-06-03 18:41:09
nuclei
nuclei
Grafana 3.0.1-7.0.1 - Server-Side Request Forgery
2022-12-08 00:39:09
nvd
nvd
CVE-2020-13379
2020-06-03 19:15:10
exploitdb
exploitdb
Grafana 7.0.1 - Denial of Service (PoC)
2020-07-06 00:00:00
alpinelinux
alpinelinux
CVE-2020-13379
2020-06-03 19:15:10
attackerkb
attackerkb
CVE-2020-13379
2020-06-03 00:00:00
openvas
openvas
Grafana 3.0.1 < 6.7.4, 7.0 < 7.0.2 SSRF Vulnerability
2020-06-08 00:00:00
Fedora: Security Advisory for grafana (FEDORA-2020-a09e5be0be)
2020-06-23 00:00:00
openSUSE: Security Advisory for grafana, (openSUSE-SU-2020:0892-1)
2020-06-29 00:00:00
suse
suse
Security update for grafana (moderate)
2020-10-10 00:00:00
Security update for grafana, grafana-piechart-panel, grafana-status-panel (moderate)
2020-06-28 00:00:00
Security update for grafana (moderate)
2020-10-04 00:00:00
fedora
fedora
[SECURITY] Fedora 32 Update: grafana-6.7.4-1.fc32
2020-06-16 01:31:15
[SECURITY] Fedora 31 Update: grafana-6.7.4-1.fc31
2020-06-15 02:07:15

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

AI Score

8.1

Confidence

High

EPSS

0.717

Percentile

98.1%

JSON
Related for CVE-2020-13379
osv4nessus14packetstorm1avleonov1redhat8oraclelinux3zdt1prion1veracode1github1altlinux2redhatcve1ubuntucve1cvelist1nuclei1nvd1exploitdb1alpinelinux1attackerkb1openvas6suse4fedora2