Type Vulnerability
Grafana contains a path traversal vulnerability that could allow access to local files. Known-exploited catalogue reports exploitation in the wild.
Grafana · Path traversal
Grafana Path Traversal Vulnerability
CVE-2021-43798
What this means
This is rated high severity (7.5 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Grafana Grafana is in your estate, and treat that as the priority.
Full vendor description
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
Scoring and exploitation
7.5/ 10
CVSS 3.1 base scoreHigh
Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityNoneI:N
AvailabilityNoneA:N
- Elevated attack likelihood (~88.5% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Grafana Labs Grafana
Weaknesses
CWE-22
Affected products ()
- Grafana Grafana
Show the raw CPE strings (5)
- cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:8.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:8.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:8.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:8.3.0:*:*:*:*:*:*:*
References
17 links from the CVE record, grouped by site; the vendor's advisory comes first.
github.com2 linksVendor advisory
- c798c0e958d15d9cc7f27c72113d572fa58545ce (opens in a new tab)Patch · Third Party Advisory
- GHSA-8pjx-jj86-j47p (opens in a new tab)Patch · Vendor Advisory
grafana.com1 linkVendor advisory
packetstormsecurity.com2 links
- Grafana-Arbitrary-File-Reading.html (opens in a new tab)Third Party Advisory · VDB Entry
- Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html (opens in a new tab)Exploit · Third Party Advisory · VDB Entry
openwall.com2 links
- 2 (opens in a new tab)Mailing List · Patch · Third Party Advisory
- 4 (opens in a new tab)Mailing List · Patch · Third Party Advisory
security.netapp.com1 link
- ntap-20211229-0004 (opens in a new tab)Third Party Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource