Vulnerability in N/a
CVE-2020-13379
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client…
EPSS: 0.931 (99.8th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- community.grafana.com/t/release-notes-v6-7-x/27119 (x_refsource_MISC)
- www.openwall.com/lists/oss-security/2020/06/03/4 (x_refsource_CONFIRM)
- community.grafana.com/t/grafana-7-0-2-and-6-7-4-security-update/31408 (x_refsource_MISC)
- grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-sec… (x_refsource_CONFIRM)
- community.grafana.com/t/release-notes-v7-0-x/29381 (x_refsource_MISC)
- security.netapp.com/advisory/ntap-20200608-0006/ (x_refsource_CONFIRM)
- [oss-security] 20200609 Re: Grafana 6.7.4 and 7.0.2 released with fix for CVE-2020-13379 (mailing-list, x_refsource_MLIST)
- FEDORA-2020-e6e81a03d6 (vendor-advisory, x_refsource_FEDORA)
- FEDORA-2020-a09e5be0be (vendor-advisory, x_refsource_FEDORA)
- openSUSE-SU-2020:0892 (vendor-advisory, x_refsource_SUSE)
Frequently asked questions
- What is CVE-2020-13379?
- CVE-2020-13379 is a vulnerability in N/a. Published 2020-06-03.
- Is CVE-2020-13379 known to be exploited?
- 22 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.