Description
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| grafana | grafana | >= 8.0.0, < 8.0.7, >= 8.1.0, < 8.1.8, >= 8.2.0, < 8.2.7, = 8.3.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | grafana | 8.5.13-150200.3.29.5 | SUSE-SU-2022:4428-1 |
| SLES 12 SP5 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2022:2134-1 |
| SLES 12 SP4 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2022:2134-1 |
| SLES 12 SP3 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2022:2134-1 |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2022:2134-1 |
| SLES for SAP 12 SP4 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2022:2134-1 |
| SLES for SAP 12 SP3 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2022:2134-1 |
| SUSE OpenStack Cloud Crowbar 9 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2022:2134-1 |
| SUSE OpenStack Cloud Crowbar 8 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2022:2134-1 |
| SUSE OpenStack Cloud 9 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2022:2134-1 |
| SUSE OpenStack Cloud 8 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2022:2134-1 |
| SUSE Manager Server Module 4.3 | golang-github-lusitaniae-apache_exporter | 1.0.0-150000.1.20.1 | SUSE-SU-2024:0487-1 |
| SUSE Manager Server Module 4.2 | prometheus-postgres_exporter | 0.10.0-150000.1.3.1 | SUSE-SU-2022:1396-1 |
| SUSE Manager Proxy Module 4.3 | golang-github-boynux-squid_exporter | 1.6-150000.1.9.1 | SUSE-SU-2022:4437-1 |
| SUSE Manager Proxy Module 4.3 | golang-github-lusitaniae-apache_exporter | 1.0.0-150000.1.20.1 | SUSE-SU-2024:0487-1 |
| SUSE Manager Proxy Module 4.3 | prometheus-blackbox_exporter | 0.19.0-150000.1.14.3 | SUSE-SU-2022:4437-1 |
| SUSE Manager Proxy Module 4.2 | golang-github-boynux-squid_exporter | 1.6-150000.1.9.1 | SUSE-SU-2022:4437-1 |
| SUSE Manager Proxy Module 4.2 | prometheus-blackbox_exporter | 0.19.0-150000.1.14.3 | SUSE-SU-2022:4437-1 |
| SUSE Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0.1.1665997480.587fa10-150000.1.41.1 | SUSE-SU-2022:4437-1 |
| SUSE Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0.19.0-150000.1.14.3 | SUSE-SU-2022:4437-1 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-proxy-systemd-services | 4.3.7-150000.1.9.3 | SUSE-SU-2024:0487-1, SUSE-SU-2022:4437-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | dracut-saltboot | 0.1.1681904360.84ef141-159000.3.30.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | golang-github-QubitProducts-exporter_exporter | 0.4.0-159000.4.6.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | prometheus-blackbox_exporter | 0.24.0-159000.3.6.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | uyuni-proxy-systemd-services | 5.0.1-159000.3.9.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | ansible | 2.9.27-159000.3.9.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 0.1.1665997480.587fa10-150000.1.41.1 | SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1 |
| SUSE Manager Client Tools 15 | golang-github-QubitProducts-exporter_exporter | 0.4.0-159000.4.6.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | golang-github-boynux-squid_exporter | 1.6-150000.1.9.1 | SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1 |
| SUSE Manager Client Tools 15 | golang-github-lusitaniae-apache_exporter | 1.0.0-150000.1.20.1 | SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 2.45.0-150000.3.53.1 | SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | grafana | 8.3.5-150000.1.30.1 | SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1 |
| SUSE Manager Client Tools 15 | mgr-cfg | 4.2.8-150000.1.24.1 | SUSE-SU-2022:1396-1 |
| SUSE Manager Client Tools 15 | mgr-daemon | 4.3.8-150000.1.44.1 | SUSE-SU-2024:0487-1 |
| SUSE Manager Client Tools 15 | mgr-osad | 4.2.8-150000.1.36.1 | SUSE-SU-2022:1396-1 |
| SUSE Manager Client Tools 15 | mgr-push | 4.2.5-150000.1.18.2 | SUSE-SU-2024:0196-1, SUSE-SU-2022:1396-1 |
| SUSE Manager Client Tools 15 | mgr-virtualization | 4.2.4-150000.1.26.1 | SUSE-SU-2022:1396-1 |
| SUSE Manager Client Tools 15 | prometheus-blackbox_exporter | 0.19.0-150000.1.14.3 | SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1 |
| SUSE Manager Client Tools 15 | prometheus-postgres_exporter | 0.10.0-150000.1.3.1 | SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2022:1396-1 |
| SUSE Manager Client Tools 15 | python-hwdata | 2.3.5-159000.5.13.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | python-pyvmomi | 6.7.3-159000.3.6.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | rhnlib | 4.2.6-150000.3.34.1 | SUSE-SU-2024:0196-1, SUSE-SU-2022:1396-1 |
| SUSE Manager Client Tools 15 | spacecmd | 4.2.16-150000.3.77.1 | SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1 |
| SUSE Manager Client Tools 15 | spacewalk-client-tools | 4.2.18-150000.3.59.1 | SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1 |
| SUSE Manager Client Tools 15 | spacewalk-koan | 4.2.6-150000.3.27.1 | SUSE-SU-2022:1396-1 |
| SUSE Manager Client Tools 15 | spacewalk-oscap | 4.2.4-150000.3.18.1 | SUSE-SU-2022:1396-1 |
| SUSE Manager Client Tools 15 | supportutils-plugin-salt | 1.2.2-159000.5.9.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | supportutils-plugin-susemanager-client | 5.0.1-159000.6.15.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | suseRegisterInfo | 4.2.6-150000.3.21.1 | SUSE-SU-2022:1396-1 |
| SUSE Manager Client Tools 15 | uyuni-common-libs | 5.0.1-159000.3.33.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | uyuni-proxy-systemd-services | 4.3.7-150000.1.9.3 | SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1 |
| SUSE Manager Client Tools 12 | golang-github-QubitProducts-exporter_exporter | 0.4.0-1.6.1 | SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | golang-github-boynux-squid_exporter | 1.6-1.9.1 | SUSE-SU-2024:0191-1, SUSE-SU-2022:4439-1 |
| SUSE Manager Client Tools 12 | golang-github-lusitaniae-apache_exporter | 1.0.0-1.21.2 | SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-alertmanager | 0.23.0-1.12.3 | SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-prometheus | 2.45.0-1.50.2 | SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-promu | 0.14.0-4.12.2 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | grafana | 8.3.5-1.30.3 | SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2022:4439-1 |
| SUSE Manager Client Tools 12 | kiwi-desc-saltboot | 0.1.1687520761.cefb248-4.15.2 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | mgr-cfg | 4.3.6-1.27.4 | SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | mgr-custom-info | 4.3.3-1.18.1 | SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | mgr-daemon | 4.3.4-1.32.3 | SUSE-SU-2024:0486-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | mgr-osad | 4.3.6-1.39.4 | SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | mgr-push | 4.3.4-1.21.4 | SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | mgr-virtualization | 4.3.5-1.29.3 | SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | prometheus-blackbox_exporter | 0.19.0-1.8.2 | SUSE-SU-2024:0191-1, SUSE-SU-2022:4439-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | prometheus-postgres_exporter | 0.10.0-1.8.2 | SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | python-hwdata | 2.3.5-12.9.1 | SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | rhnlib | 4.3.4-21.43.3 | SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | spacecmd | 4.3.11-38.103.3 | SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2022:4439-1 |
| SUSE Manager Client Tools 12 | spacewalk-client-tools | 4.3.9-52.71.3 | SUSE-SU-2024:0486-1, SUSE-SU-2022:4439-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | spacewalk-koan | 4.3.5-24.33.3 | SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | spacewalk-oscap | 4.3.5-19.27.1 | SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | spacewalk-remote-utils | 4.3.3-24.24.3 | SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | supportutils-plugin-salt | 1.2.0-6.16.1 | SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | supportutils-plugin-susemanager-client | 4.3.2-6.24.1 | SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | suseRegisterInfo | 4.3.3-25.27.3 | SUSE-SU-2022:2134-1 |
| SUSE Manager Client Tools 12 | system-user-grafana +1 | 1.0.0-3.7.2 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | uyuni-common-libs | 4.3.4-1.21.3 | SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1 |
| SUSE HPE Helion OpenStack 8 | golang-github-prometheus-node_exporter | 1.3.0-1.15.3 | SUSE-SU-2022:2134-1 |
| SUSE Enterprise Storage 6 | grafana | 8.5.13-150100.3.12.1 | SUSE-SU-2022:3676-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 8.3.4-1.1 | openSUSE-SU-2024:11816-1 |
| openSUSE Leap 15.5 | golang-github-lusitaniae-apache_exporter | 1.0.0-150000.1.20.1 | SUSE-SU-2024:0487-1 |
| openSUSE Leap 15.5 | prometheus-postgres_exporter | 0.10.1-150000.1.17.1 | SUSE-SU-2024:0487-1 |
| openSUSE Leap 15.5 | spacecmd | 4.3.26-150000.3.113.1 | SUSE-SU-2024:0487-1 |
| openSUSE Leap 15.4 | dracut-saltboot | 0.1.1665997480.587fa10-150000.1.41.1 | SUSE-SU-2022:4437-1 |
| openSUSE Leap 15.4 | golang-github-boynux-squid_exporter | 1.6-150000.1.9.1 | SUSE-SU-2022:4437-1 |
| openSUSE Leap 15.4 | golang-github-prometheus-promu | 0.13.0-150000.3.9.1 | SUSE-SU-2022:4437-1 |
| openSUSE Leap 15.4 | grafana | 8.3.5-150200.3.21.1 | SUSE-SU-2022:4428-1, SUSE-FU-2022:1419-1 |
| openSUSE Leap 15.4 | prometheus-blackbox_exporter | 0.19.0-150000.1.14.3 | SUSE-SU-2022:4437-1 |
| openSUSE Leap 15.4 | spacecmd | 4.3.16-150000.3.89.1 | SUSE-SU-2022:4437-1 |
| openSUSE Leap 15.4 | wire | 0.5.0-150000.1.9.3 | SUSE-SU-2022:4437-1 |
| openSUSE Leap 15.3 | dracut-saltboot | 0.1.1665997480.587fa10-150000.1.41.1 | SUSE-SU-2022:4437-1 |
| openSUSE Leap 15.3 | golang-github-boynux-squid_exporter | 1.6-150000.1.9.1 | SUSE-SU-2022:4437-1 |
| openSUSE Leap 15.3 | golang-github-prometheus-promu | 0.13.0-150000.3.9.1 | SUSE-SU-2022:4437-1 |
| openSUSE Leap 15.3 | grafana | 8.3.5-150200.3.21.1 | SUSE-SU-2022:4428-1, SUSE-FU-2022:1419-1 |
| openSUSE Leap 15.3 | prometheus-postgres_exporter | 0.10.0-150000.1.3.1 | SUSE-SU-2022:1396-1 |
| openSUSE Leap 15.3 | rhnlib | 4.2.6-150000.3.34.1 | SUSE-SU-2022:1396-1 |
| openSUSE Leap 15.3 | spacecmd | 4.2.16-150000.3.77.1 | SUSE-SU-2022:4437-1, SUSE-SU-2022:1396-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 8.3.1-r0 | — |
| Alpine v3.23 | grafana | 8.3.1-r0 | — |
| Alpine v3.22 | grafana | 8.3.1-r0 | — |
| Alpine v3.21 | grafana | 8.3.1-r0 | — |
| Alpine v3.20 | grafana | 8.3.1-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | grafana | 8.3.1-r0 | — |
| Alpine v3.18 | grafana | 8.3.1-r0 | — |
| Alpine v3.17 | grafana | 8.3.1-r0 | — |
| Alpine v3.16 | grafana | 8.3.1-r0 | — |
| Alpine v3.15 | grafana | 8.2.7-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Grafana Plugin Path Traversal
auxiliary/scanner/http/grafana_plugin_traversal
Exploit-DB 1
- Grafana 8.3.0 - Directory Traversal and Arbitrary File Read EDB-50581 · webapps · Dec 9, 2021
GitHub 59 repositories · most starred shown
-
jas502n/Grafana-CVE-2021-43798 ★ 370 · Dec 7, 2021
Grafana Unauthorized arbitrary file reading vulnerability
-
A-D-Team/grafanaExp ★ 270 · Dec 7, 2021
A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability (CVE-2021-43798), it can burst plugins / extract secret_key / decrypt data_source info automatic.
-
pedrohavay/exploit-grafana-CVE-2021-43798 ★ 46 · Dec 11, 2021
This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability (CVE-2021-43798).
-
taythebot/CVE-2021-43798 ★ 43 · Dec 6, 2021
CVE-2021-43798 - Grafana 8.x Path Traversal (Pre-Auth)
-
zer0yu/CVE-2021-43798 ★ 27 · Dec 7, 2021
Grafana Arbitrary File Reading Vulnerability
-
Mr-xn/CVE-2021-43798 ★ 24 · Dec 7, 2021
CVE-2021-43798:Grafana 任意文件读取漏洞
-
MoCh3n/CVE-2021-43798-grafana_fileread ★ 17 · Dec 8, 2021
grafana CVE-2021-43798任意文件读取漏洞POC，采用多插件轮训检测的方法，允许指定单URL和从文件中读取URL
-
ScorpionsMAX/CVE-2021-43798-Grafana-POC ★ 14 · Dec 7, 2021
CVE-2021-43798 Grafana 任意文件读取漏洞 POC+参数
-
asaotomo/CVE-2021-43798-Grafana-Exp ★ 12 · Dec 7, 2021
Grafanav8.*版本任意文件读取漏洞批量检测工具：该漏洞目前为0day漏洞，未授权的攻击者利用该漏洞，能够获取服务器敏感文件。
-
Mo0ns/Grafana_POC-CVE-2021-43798 ★ 9 · Dec 9, 2021
Grafana-POC任意文件读取漏洞(CVE-2021-43798)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Grafana v8.x - Arbitrary File Read http/cves/2021/CVE-2021-43798.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | >= 8.3.0, < 8.3.1 | 8.3.1 | GHSA-8pjx-jj86-j47p |
| Go | github.com/grafana/grafana | >= 8.2.0, < 8.2.7 | 8.2.7 | GHSA-8pjx-jj86-j47p |
| Go | github.com/grafana/grafana | >= 8.1.0, < 8.1.8 | 8.1.8 | GHSA-8pjx-jj86-j47p |
| Go | github.com/grafana/grafana | >= 8.0.0-beta1, < 8.0.7 | 8.0.7 | GHSA-8pjx-jj86-j47p |
Advisories 13
- SUSE-SU-2022:3676-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-FU-2022:1419-1 Feature update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4439-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0191-1 Security Beta update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11816-1 grafana-8.3.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1396-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4437-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4428-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2134-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0486-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0196-1 Security Beta update for SUSE Manager Client Tools and Salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0487-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2022-0404 Grafana: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Feb 15, 2024
References
- https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
- https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce
- http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html
- https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/
- http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html
- [oss-security] 20211209 CVE-2021-43798 Grafana directory traversal mailing-list
- [oss-security] 20211210 CVE-2021-43813 and CVE-2021-43815 - Grafana directory traversal for some .md and .csv files mailing-list
- https://security.netapp.com/advisory/ntap-20211229-0004/