PT-2020-13124 · Grafana+4 · Grafana+4

Published 2020-03-03 · Updated 2024-07-02 · CVE-2020-12459

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Grafana versions 6.0.0 through 6.3.6 Grafana versions prior to 7.2.1

Description The configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml are world readable, containing a secret key and a bind password.

Recommendations For Grafana versions 6.0.0 through 6.3.6, update to version 7.2.1 or later to resolve the issue. For Grafana versions prior to 7.2.1, update to version 7.2.1 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml to restrict read access.

Fix

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-200

CWE-732

Related Identifiers

ALSA-2020:4682

ALT-PU-2020-1420

ALT-PU-2020-2204

BIT-GRAFANA-2020-12459

CESA-2020_4682

CVE-2020-12459

GHSA-M25M-5778-FM22

GO-2024-2519

RHSA-2020:2362

RHSA-2020:4682

RHSA-2020_4682

Affected Products

Alt Linux

Almalinux

Centos

Grafana

Red Hat

References · 30

• https://github.com/grafana/grafana/issues/8283 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-12459 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTQCKJZZYXMCSHJFZZ3YXEO5NUBANGZS · Vendor Advisory
• https://osv.dev/vulnerability/BIT-grafana-2020-12459 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WEBCIEVSYIDDCA7FTRS2IFUOYLIQU34A · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12459 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4682.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m25m-5778-fm22 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2519 · Vendor Advisory
• https://src.fedoraproject.org/rpms/grafana/c/fab93d67363eb0a9678d9faf160cc88237f26277 · Patch
• https://osv.dev/vulnerability/ALSA-2020:4682 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/CTQCKJZZYXMCSHJFZZ3YXEO5NUBANGZS · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WEBCIEVSYIDDCA7FTRS2IFUOYLIQU34A · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12459 · Security Note
• https://github.com/grafana/grafana · Note