GHSA-wc9w-wvq2-ffm9MediumCVSS 5.4

Server Side Request Forgery in Grafana

Published
February 15, 2022
Last Modified
October 2, 2023

🔗 CVE IDs covered (1)

CVE-2020-13379 →

📋 Description

The avatar feature in Grafana (github.com/grafana/grafana/pkg/api/avatar) 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue that allows remote code execution. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on.

🎯 Affected products2

  • go/github.com/grafana/grafana:>= 3.0.1, < 6.7.4
  • go/github.com/grafana/grafana:>= 7.0.0, < 7.0.2

🔗 References (32)