CVE-2022-32275

2022-06-0618:29:07

mitre

github.com

grafana

file reading

vulnerability

AI Score

6.7

Confidence

Low

EPSS

0.003

Percentile

69.7%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor’/… /… /… /… /… /… /… /… /etc/passwd URI. NOTE: the vendor’s position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:grafana:grafana:-:*:*:*:enterprise:*:*:*"
    ],
    "vendor": "grafana",
    "product": "grafana",
    "versions": [
      {
        "status": "affected",
        "version": "8.4.3"
      }
    ],
    "defaultStatus": "unknown"
  }
]