Most recent entries from all

bdu:2023-00493

BIT-grafana-2021-43798 — Grafana path traversal

Affected: Bitnami: grafana

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

EUVD-2026-255903

fkie_cve-2021-43798

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

GHSA-8pjx-jj86-j47p — Grafana path traversal

Affected: Go: github.com/grafana/grafana

Today we are releasing Grafana 8.3.1, 8.2.7, 8.1.8, 8.0.7. This patch release includes a high severity security fix that affects Grafana versions from v8.0.0-beta1 through v8.3.0.

Release v8.3.1, only containing a security fix:

- [Download Grafana 8.3.1](https://grafana.com/grafana/download/8.3.1) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-1/)

Release v8.2.7, only containing a security fix:

- [Download Grafana 8.2.7](https://grafana.com/grafana/download/8.2.7) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-2-7/)

Release v8.1.8, only containing a security fix:

- [Download Grafana 8.1.8](https://grafana.com/grafana/download/8.1.8) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-8/)

Release v8.0.7, only containing a security fix:

- [Download Grafana 8.0.7](https://grafana.com/grafana/download/8.0.7) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-0-7/)

## Path Traversal ([CVE-2021-43798](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43798))

### Summary

On 2021-12-03, we received a report that Grafana is vulnerable to directory traversal, allowing access to local files. We have confirmed this for versions 8.0.0-beta1 to 8.3.0. Thanks to our defense-in-depth approach, at no time has [Grafana Cloud](https://grafana.com/cloud) been vulnerable.

The vulnerable URL path is: <grafana_host_url>/p…

gsd-2021-43798

openSUSE-SU-2024:11816-1 — grafana-8.3.4-1.1 on GA media

grafana-8.3.4-1.1 on GA media

SUSE-FU-2022:1419-1 — Feature update for grafana

Feature update for grafana

Withdrawn: UBUNTU-CVE-2021-43798

Withdrawn by the publisher.

Affected: Ubuntu:16.04:LTS: grafana

WID-SEC-W-2022-0404 — Grafana: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Grafana ausnutzen, um Informationen offenzulegen.