Lucene search

Veracode Vulnerability DatabaseVERACODE:33292

HistoryDec 13, 2021 - 6:13 a.m.

Path Traversal

2021-12-1306:13:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

path traversal

github

grafana

vulnerability

authenticated attacker

testdata db

data source

csv files

EPSS

0.001

Percentile

46.4%

JSON

github.com/grafana/grafana is vulnerable to path traversal. An authenticated attacker can access files outside the expected directory through the arbitrary .csv files when the TestData DB data source is enabled and configured.

References

www.openwall.com/lists/oss-security/2021/12/10/4

github.com/grafana/grafana/commit/d6ec6f8ad28f0212e584406730f939105ff6c6d3

github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d

github.com/grafana/grafana/pull/42979

github.com/grafana/grafana/releases/tag/v8.3.2

github.com/grafana/grafana/security/advisories/GHSA-7533-c8qv-jm9m

grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/

security.netapp.com/advisory/ntap-20220107-0006/