CVE-2021-43813mediumCWE-22

CVE-2021-43813: medium-severity vulnerability in grafana

Directory Traversal in Grafana

Published · Updated

Follow this CVE+ Monitor Grafana+ Monitor grafana

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 57%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
7 products (14 components)
OpenShift Service Mesh 2.0 · Red Hat Ceph Storage 3 · OpenShift Service Mesh 2.1 · Red Hat Ceph Storage 2 · Red Hat Storage 3 · and others 2
none_available: Affected
Fixed
3 products (16 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat OpenShift Container Platform 4.10 · Red Hat Ceph Storage 5.2 Tools
fix ↗
Not affected
4 products (556 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 4.10 · Red Hat Ceph Storage 5.2 Tools · Red Hat Enterprise Linux 9 · Red Hat Advanced Cluster Management for Kubernetes 2
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
grafana · grafana
Related CVEs — grafana

In the same product, most dangerous first.

CVE-2021-39226CRITICALSnapshot authentication bypass in grafanaEPSS 99.9%KEVCVE-2021-43798HIGHGrafana path traversalEPSS 88.5%KEVCVE-2021-41174MEDIUMXSS vulnerability allowing arbitrary JavaScript executionEPSS 85.4%CVE-2022-31097HIGHStored XSS in Grafana's Unified AlertingEPSS 70.1%CVE-2021-41244CRITICALCross organization admin control in GrafanaEPSS 2.9%CVE-2022-31107HIGHGrafana account takeover via OAuth vulnerabilityEPSS 2.9%