Skip to content
OpenAdvisories
Medium · 4.3 CVE-2021-43815 BIT-grafana-2021-43815EUVD-2024-1473GHSA-7533-c8qv-jm9m

Grafana directory traversal for `.cvs` files

Published Dec 10, 2021 · Updated Aug 4, 2024 · Assigned by GitHub_M

Vendor: Grafana Product: Grafana Package: github.com/grafana/grafana Package: grafana Package: grafana Category: Web / CMS Ecosystem: Alpine Ecosystem: Go Ecosystem: Ubuntu

Description

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.

Affected products

VendorProductAffectedFixed
grafana grafana >= 8.0.0-beta3, < 8.3.2, >= 5.0.0, < 7.5.12 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 grafana 8.5.13-150200.3.29.5 SUSE-SU-2022:4428-1
SLES 12 SP5 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2022:2134-1
SLES 12 SP4 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2022:2134-1
SLES 12 SP3 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2022:2134-1
Show 17 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP5 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2022:2134-1
SLES for SAP 12 SP4 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2022:2134-1
SLES for SAP 12 SP3 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2022:2134-1
SUSE OpenStack Cloud Crowbar 9 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2022:2134-1
SUSE OpenStack Cloud Crowbar 8 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2022:2134-1
SUSE OpenStack Cloud 9 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2022:2134-1
SUSE OpenStack Cloud 8 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2022:2134-1
SUSE Manager Server Module 4.3 golang-github-lusitaniae-apache_exporter 1.0.0-150000.1.20.1 SUSE-SU-2024:0487-1
SUSE Manager Server Module 4.2 prometheus-postgres_exporter 0.10.0-150000.1.3.1 SUSE-SU-2022:1396-1
SUSE Manager Proxy Module 4.3 golang-github-boynux-squid_exporter 1.6-150000.1.9.1 SUSE-SU-2022:4437-1
SUSE Manager Proxy Module 4.3 golang-github-lusitaniae-apache_exporter 1.0.0-150000.1.20.1 SUSE-SU-2024:0487-1
SUSE Manager Proxy Module 4.3 prometheus-blackbox_exporter 0.19.0-150000.1.14.3 SUSE-SU-2022:4437-1
SUSE Manager Proxy Module 4.2 golang-github-boynux-squid_exporter 1.6-150000.1.9.1 SUSE-SU-2022:4437-1
SUSE Manager Proxy Module 4.2 prometheus-blackbox_exporter 0.19.0-150000.1.14.3 SUSE-SU-2022:4437-1
SUSE Manager Client Tools for SLE Micro 5 dracut-saltboot 0.1.1665997480.587fa10-150000.1.41.1 SUSE-SU-2022:4437-1
SUSE Manager Client Tools for SLE Micro 5 prometheus-blackbox_exporter 0.19.0-150000.1.14.3 SUSE-SU-2022:4437-1
SUSE Manager Client Tools for SLE Micro 5 uyuni-proxy-systemd-services 4.3.7-150000.1.9.3 SUSE-SU-2024:0487-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools Beta for SLE Micro 5 dracut-saltboot 0.1.1681904360.84ef141-159000.3.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 uyuni-proxy-systemd-services 5.0.1-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 ansible 2.9.27-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 dracut-saltboot 0.1.1665997480.587fa10-150000.1.41.1 SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-boynux-squid_exporter 1.6-150000.1.9.1 SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 golang-github-lusitaniae-apache_exporter 1.0.0-150000.1.20.1 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-prometheus-prometheus 2.45.0-150000.3.53.1 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 grafana 8.3.5-150000.1.30.1 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 mgr-cfg 4.2.8-150000.1.24.1 SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15 mgr-daemon 4.3.8-150000.1.44.1 SUSE-SU-2024:0487-1
SUSE Manager Client Tools 15 mgr-osad 4.2.8-150000.1.36.1 SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15 mgr-push 4.2.5-150000.1.18.2 SUSE-SU-2024:0196-1, SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15 mgr-virtualization 4.2.4-150000.1.26.1 SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15 prometheus-blackbox_exporter 0.19.0-150000.1.14.3 SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 prometheus-postgres_exporter 0.10.0-150000.1.3.1 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15 python-hwdata 2.3.5-159000.5.13.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-pyvmomi 6.7.3-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 rhnlib 4.2.6-150000.3.34.1 SUSE-SU-2024:0196-1, SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15 spacecmd 4.2.16-150000.3.77.1 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 spacewalk-client-tools 4.2.18-150000.3.59.1 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 spacewalk-koan 4.2.6-150000.3.27.1 SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15 spacewalk-oscap 4.2.4-150000.3.18.1 SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15 supportutils-plugin-salt 1.2.2-159000.5.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 supportutils-plugin-susemanager-client 5.0.1-159000.6.15.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 suseRegisterInfo 4.2.6-150000.3.21.1 SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15 uyuni-common-libs 5.0.1-159000.3.33.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 uyuni-proxy-systemd-services 4.3.7-150000.1.9.3 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 12 golang-github-QubitProducts-exporter_exporter 0.4.0-1.6.1 SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 golang-github-boynux-squid_exporter 1.6-1.9.1 SUSE-SU-2024:0191-1, SUSE-SU-2022:4439-1
SUSE Manager Client Tools 12 golang-github-lusitaniae-apache_exporter 1.0.0-1.21.2 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-alertmanager 0.23.0-1.12.3 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 golang-github-prometheus-prometheus 2.45.0-1.50.2 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-promu 0.14.0-4.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 grafana 8.3.5-1.30.3 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2022:4439-1
SUSE Manager Client Tools 12 kiwi-desc-saltboot 0.1.1687520761.cefb248-4.15.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 mgr-cfg 4.3.6-1.27.4 SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 mgr-custom-info 4.3.3-1.18.1 SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 mgr-daemon 4.3.4-1.32.3 SUSE-SU-2024:0486-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 mgr-osad 4.3.6-1.39.4 SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 mgr-push 4.3.4-1.21.4 SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 mgr-virtualization 4.3.5-1.29.3 SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 prometheus-blackbox_exporter 0.19.0-1.8.2 SUSE-SU-2024:0191-1, SUSE-SU-2022:4439-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 prometheus-postgres_exporter 0.10.0-1.8.2 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 python-hwdata 2.3.5-12.9.1 SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 rhnlib 4.3.4-21.43.3 SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 spacecmd 4.3.11-38.103.3 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2022:4439-1
SUSE Manager Client Tools 12 spacewalk-client-tools 4.3.9-52.71.3 SUSE-SU-2024:0486-1, SUSE-SU-2022:4439-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 spacewalk-koan 4.3.5-24.33.3 SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 spacewalk-oscap 4.3.5-19.27.1 SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 spacewalk-remote-utils 4.3.3-24.24.3 SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 supportutils-plugin-salt 1.2.0-6.16.1 SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client 4.3.2-6.24.1 SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 suseRegisterInfo 4.3.3-25.27.3 SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12 system-user-grafana +1 1.0.0-3.7.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 uyuni-common-libs 4.3.4-1.21.3 SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE HPE Helion OpenStack 8 golang-github-prometheus-node_exporter 1.3.0-1.15.3 SUSE-SU-2022:2134-1
SUSE Enterprise Storage 6 grafana 8.5.13-150100.3.12.1 SUSE-SU-2022:3676-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 10.1.5-2.1 openSUSE-SU-2024:13586-1
openSUSE Leap 15.5 golang-github-lusitaniae-apache_exporter 1.0.0-150000.1.20.1 SUSE-SU-2024:0487-1
openSUSE Leap 15.5 prometheus-postgres_exporter 0.10.1-150000.1.17.1 SUSE-SU-2024:0487-1
openSUSE Leap 15.5 spacecmd 4.3.26-150000.3.113.1 SUSE-SU-2024:0487-1
openSUSE Leap 15.4 dracut-saltboot 0.1.1665997480.587fa10-150000.1.41.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.4 golang-github-boynux-squid_exporter 1.6-150000.1.9.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.4 golang-github-prometheus-promu 0.13.0-150000.3.9.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.4 grafana 8.3.5-150200.3.21.1 SUSE-SU-2022:4428-1, SUSE-FU-2022:1419-1
openSUSE Leap 15.4 prometheus-blackbox_exporter 0.19.0-150000.1.14.3 SUSE-SU-2022:4437-1
openSUSE Leap 15.4 spacecmd 4.3.16-150000.3.89.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.4 wire 0.5.0-150000.1.9.3 SUSE-SU-2022:4437-1
openSUSE Leap 15.3 dracut-saltboot 0.1.1665997480.587fa10-150000.1.41.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.3 golang-github-boynux-squid_exporter 1.6-150000.1.9.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.3 golang-github-prometheus-promu 0.13.0-150000.3.9.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.3 grafana 8.3.5-150200.3.21.1 SUSE-SU-2022:4428-1, SUSE-FU-2022:1419-1
openSUSE Leap 15.3 prometheus-postgres_exporter 0.10.0-150000.1.3.1 SUSE-SU-2022:1396-1
openSUSE Leap 15.3 rhnlib 4.2.6-150000.3.34.1 SUSE-SU-2022:1396-1
openSUSE Leap 15.3 spacecmd 4.2.16-150000.3.77.1 SUSE-SU-2022:4437-1, SUSE-SU-2022:1396-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 grafana 8.3.2-r0 —
Alpine v3.23 grafana 8.3.2-r0 —
Alpine v3.22 grafana 8.3.2-r0 —
Alpine v3.21 grafana 8.3.2-r0 —
Alpine v3.20 grafana 8.3.2-r0 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 grafana 8.3.2-r0 —
Alpine v3.18 grafana 8.3.2-r0 —
Alpine v3.17 grafana 8.3.2-r0 —
Alpine v3.16 grafana 8.3.2-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/grafana/grafana >= 8.0.0-beta3, < 8.3.2 8.3.2 GHSA-7533-c8qv-jm9m

Advisories 13

References