PT-2020-10171 · Grafana+4 · Grafana+4

Yuriy Dyachenko · Published 2020-03-03 · Updated 2024-03-28 · CVE-2019-19499

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grafana versions 6.4.3 and earlier

Description The issue allows an authenticated attacker with privileges to modify data source configurations to read arbitrary files. This can be exploited by an attacker who has the necessary permissions to access and modify the data source configurations.

Recommendations For Grafana versions 6.4.3 and earlier, update to a version later than 6.4.3 to resolve the issue. At the moment, there is no information about other specific fixes for this vulnerability.

Exploit

Fix

Information Disclosure

Path traversal

SQL injection

Weakness Enumeration

CWE-200

CWE-22

CWE-89

Related Identifiers

ALSA-2020:4682

ALT-PU-2020-1420

ALT-PU-2020-2204

CESA-2020_4682

CVE-2019-19499

ECHO-A232-FE57-D062

GHSA-4PWP-CX67-5CPX

GO-2024-2661

RHSA-2020:4682

RHSA-2020_4682

SUSE-SU-2021:1233-1

Affected Products

Alt Linux

Almalinux

Centos

Grafana

Red Hat

References · 40

• 🔥 https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read · Exploit
• https://osv.dev/vulnerability/CVE-2019-19499 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2661 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19499 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:1233-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4682.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19499 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4pwp-cx67-5cpx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19499 · Security Note
• https://osv.dev/vulnerability/ALSA-2020:4682 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19499 · Vendor Advisory
• https://github.com/grafana/grafana · Note
• https://github.com/grafana/grafana/pull/20192 · Note
• https://github.com/grafana/grafana/commit/19dbd27c5caa1a160bd5854b65a4e1fe2a8a4f00 · Note
• https://github.com/grafana/grafana/blob/master/CHANGELOG.md#644-2019-11-06 · Note