https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:11:22 +0000 https://cve.radiocsirt.org/vuln/bit-grafana-2021-43815 <p><strong>Affected:</strong> Bitnami: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.</p> <p><strong>Affected:</strong> Bitnami: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.</p> https://cve.radiocsirt.org/vuln/bit-grafana-2021-43815 https://cve.radiocsirt.org/vuln/cnvd-2021-100286 cnvd-2021-100286 https://cve.radiocsirt.org/vuln/cnvd-2021-100286 https://cve.radiocsirt.org/vuln/euvd-2026-32659 EUVD-2026-32659 https://cve.radiocsirt.org/vuln/euvd-2026-32659 https://cve.radiocsirt.org/vuln/fkie_cve-2021-43815 <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.</p> <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-43815 https://cve.radiocsirt.org/vuln/ghsa-7533-c8qv-jm9m <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>Today we are releasing Grafana `8.3.2` and `7.5.12`. This patch release includes a moderate severity security fix for directory traversal for arbitrary `.csv` files. It only affects instances that have the developer testing tool called [TestData DB data source](https://grafana.com/docs/grafana/latest/datasources/testdata/) enabled and configured.</p> <p>The vulnerability is limited in scope, and only allows access to files with the extension `.csv` to **authenticated users only.**</p> <p>This is a follow-up patch release to our recent [CVE-2021-43798](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43798) release. If you haven’t read about that high severity security fix, we recommend that you review the [initial blog post](https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/), along with our [update on the 0day](https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/).</p> <p>Given the attention CVE-2021-43798 has brought, there’s a risk that additional researchers will find CVE-2021-43813. Out of an abundance of caution and given that both CVE-2021-43813 and CVE-2021-pending are only CVSS Score 4.3 Moderate CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N through their limited scope we are immediately releasing to the public, and on a Friday.</p> <p>We identified several vulnerability issues in the last few weeks, and at a higher rate than in the years before. The infosec industry usually co…</p> <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>Today we are releasing Grafana `8.3.2` and `7.5.12`. This patch release includes a moderate severity security fix for directory traversal for arbitrary `.csv` files. It only affects instances that have the developer testing tool called [TestData DB data source](https://grafana.com/docs/grafana/latest/datasources/testdata/) enabled and configured.</p> <p>The vulnerability is limited in scope, and only allows access to files with the extension `.csv` to **authenticated users only.**</p> <p>This is a follow-up patch release to our recent [CVE-2021-43798](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43798) release. If you haven’t read about that high severity security fix, we recommend that you review the [initial blog post](https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/), along with our [update on the 0day](https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/).</p> <p>Given the attention CVE-2021-43798 has brought, there’s a risk that additional researchers will find CVE-2021-43813. Out of an abundance of caution and given that both CVE-2021-43813 and CVE-2021-pending are only CVSS Score 4.3 Moderate CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N through their limited scope we are immediately releasing to the public, and on a Friday.</p> <p>We identified several vulnerability issues in the last few weeks, and at a higher rate than in the years before. The infosec industry usually co…</p> https://cve.radiocsirt.org/vuln/ghsa-7533-c8qv-jm9m https://cve.radiocsirt.org/vuln/gsd-2021-43815 gsd-2021-43815 https://cve.radiocsirt.org/vuln/gsd-2021-43815 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13586-1 <p>grafana-10.1.5-2.1 on GA media</p> <p>grafana-10.1.5-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13586-1 https://cve.radiocsirt.org/vuln/suse-fu-2022:1419-1 <p>Feature update for grafana</p> <p>Feature update for grafana</p> https://cve.radiocsirt.org/vuln/suse-fu-2022:1419-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-43815 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-43815 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0405 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0405