Lucene search

GitHub_MCVE-2021-43815

HistoryDec 10, 2021 - 9:15 p.m.

CVE-2021-43815

2021-12-1021:15:09

CWE-22

GitHub_M

web.nvd.nist.gov

131

grafana

cve-2021-43815

directory traversal

testdata db

security

vulnerability

observability

monitoring

patch

workaround

reverse proxy

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

46.4%

JSON

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.

Affected configurations

Nvd

Vulners

Node

grafanagrafanaRange<7.5.12

grafanagrafanaRange8.0.0–8.3.2

VendorProductVersionCPE
grafanagrafana*cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
grafana	grafana	*	cpe:2.3:a:grafana:grafana::::::::

CNA Affected

[
  {
    "product": "grafana",
    "vendor": "grafana",
    "versions": [
      {
        "status": "affected",
        "version": ">= 8.0.0-beta3, < 8.3.2"
      },
      {
        "status": "affected",
        "version": ">= 5.0.0, < 7.5.12"
      }
    ]
  }
]