Server Side Request Forgery in Grafana
The avatar feature in Grafana (github.com/grafana/grafana/pkg/api/avatar) 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue that allows remote code execution. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-13379US | high8.2 | Exploit | ||
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP re… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00017.htmlWEB
- http://packetstormsecurity.com/files/158320/Grafana-7.0.1-Denial-Of-Service.htmlWEB
- http://www.openwall.com/lists/oss-security/2020/06/03/4WEB
- http://www.openwall.com/lists/oss-security/2020/06/09/2WEB
- https://community.grafana.com/t/grafana-7-0-2-and-6-7-4-security-update/31408WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan