Skip to content
OpenAdvisories
High ELSA-2020-2641 1 CVE

Important: grafana security update (Oracle Linux 8)

Published Jun 22, 2020 · Updated Jun 22, 2020

Ecosystem: Oracle Linux

Summary

[6.3.6-2]
- fix CVE-2020-13379

Fixed packages 13

ReleasePackageFixed in
Oracle Linux · 8 grafana 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-azure-monitor 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-cloudwatch 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-elasticsearch 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-graphite 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-influxdb 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-loki 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-mssql 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-mysql 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-opentsdb 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-postgres 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-prometheus 0:6.3.6-2.el8_2
Oracle Linux · 8 grafana-stackdriver 0:6.3.6-2.el8_2

Vulnerabilities 1

  • Medium 5.8
    CVE-2020-13379 Public exploit Scanner template EPSS 100%

    Server Side Request Forgery in Grafana

    The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to…

    github.com/grafana/grafana grafana Alpine Go