BIT-grafana-2022-32275

2024-03-0610:56:01

Google

osv.dev

grafana

file reading

vulnerability

software

0.002 Low

EPSS

Percentile

60.8%

JSON

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor’/… /… /… /… /… /… /… /… /etc/passwd URI. NOTE: the vendor’s position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content

CPENameOperatorVersion
grafanage8.4.3
grafanale8.4.3

CPE	Name	Operator	Version
	grafana	ge	8.4.3
	grafana	le	8.4.3

References

github.com/BrotherOfJhonny/grafana

github.com/BrotherOfJhonny/grafana/blob/main/README.md

github.com/grafana/grafana/issues/50336

github.com/grafana/grafana/issues/50341#issuecomment-1155252393

grafana.com

security.netapp.com/advisory/ntap-20220715-0008/

0.002 Low

EPSS

Percentile

60.8%

JSON

Related for OSV:BIT-GRAFANA-2022-32275