GitHub Advisoryadvisory · Go

GHSA-wc9w-wvq2-ffm9 Server Side Request Forgery in Grafana

MEDIUM Published 2022-02-15 Modified 2023-10-02 Official page ↗
Aliases
CVE-2020-13379
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:F/RL:O/RC:C
Weaknesses
CWE-918
Reviewed
2021-05-14

Affected packages

• Go github.com/grafana/grafana: >= 3.0.1, < 6.7.4 → fixed in 6.7.4 • Go github.com/grafana/grafana: >= 7.0.0, < 7.0.2 → fixed in 7.0.2

Description

The avatar feature in Grafana (github.com/grafana/grafana/pkg/api/avatar) 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue that allows remote code execution. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on.

Related

Alias · CVE (1)

  • CVE-2020-13379 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References