GHSA-4pwp-cx67-5cpx

Grafana Arbitrary File Read

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-19499

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/grafana/grafana	< 6.4.4	6.4.4

Details

As written in the advisory (Markdown source, shown as plain text).

Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-19499 advisory
https://github.com/grafana/grafana/pull/20192 web
https://github.com/grafana/grafana/commit/19dbd27c5caa1a160bd5854b65a4e1fe2a8a4f00 web
https://github.com/grafana/grafana package
https://github.com/grafana/grafana/blob/master/CHANGELOG.md#644-2019-11-06 web
https://security.netapp.com/advisory/ntap-20200918-0003 web