CVE-2020-13379
High
Description
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.
SeverityHigh
CVSS8.2
Exploit probability—
Product
Grafana
PublishedJun 3, 2020
First seenJun 3, 2020
How to fix
Update
- github.com/grafana/grafana6.7.4, 7.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grafana grafana | 3.0.1 ≤ v ≤ 7.0.1 | — |
| fedoraproject fedora | 31, 32 | — |
| netapp e-series_performance_analyzer | No range specified | — |
| opensuse leap | 15.2 | — |
| opensuse backports_sle | 15.0 | — |
| github.com/grafana/grafanaGo | 3.0.1 ≤ v < 6.7.4, 7.0.0 ≤ v < 7.0.2 | 6.7.4, 7.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.