CVE-2021-43798: Grafana path traversal
First published: Tue Dec 07 2021(Updated: )
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Grafana Grafana | >=8.0.1<8.0.7 | |
| Grafana Grafana | >=8.1.0<8.1.8 | |
| Grafana Grafana | >=8.2.0<8.2.7 | |
| Grafana Grafana | =8.0.0-beta1 | |
| Grafana Grafana | =8.0.0-beta2 | |
| Grafana Grafana | =8.0.0-beta3 | |
| Grafana Grafana | =8.3.0 | |
| go/github.com/grafana/grafana | >=8.0.0-beta1<8.0.7 | 8.0.7 |
| go/github.com/grafana/grafana | >=8.1.0<8.1.8 | 8.1.8 |
| go/github.com/grafana/grafana | >=8.2.0<8.2.7 | 8.2.7 |
| go/github.com/grafana/grafana | >=8.3.0<8.3.1 | 8.3.1 |
| >=8.0.1<8.0.7 | ||
| >=8.1.0<8.1.8 | ||
| >=8.2.0<8.2.7 | ||
| =8.0.0-beta1 | ||
| =8.0.0-beta2 | ||
| =8.0.0-beta3 | ||
| =8.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html
- http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html
- http://www.openwall.com/lists/oss-security/2021/12/09/2
- http://www.openwall.com/lists/oss-security/2021/12/10/4
- https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce
- https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
- https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/
- https://security.netapp.com/advisory/ntap-20211229-0004/
- https://nvd.nist.gov/vuln/detail/CVE-2021-43798
- https://github.com/advisories/GHSA-8pjx-jj86-j47p (Advisory)
Frequently Asked Questions
What is CVE-2021-43798?
CVE-2021-43798 is a vulnerability in Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) that allows directory traversal and access to local files.
How severe is CVE-2021-43798?
CVE-2021-43798 has a severity rating of 7.5 out of 10.
Which software versions are affected by CVE-2021-43798?
Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) are affected by CVE-2021-43798.
How can I fix CVE-2021-43798?
To fix CVE-2021-43798, update Grafana to a version that includes the patch.
Where can I find more information about CVE-2021-43798?
You can find more information about CVE-2021-43798 at the following references: [Reference 1](http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html), [Reference 2](http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html), [Reference 3](http://www.openwall.com/lists/oss-security/2021/12/09/2).
- collector/nvd-index
- agent/type
- agent/remedy
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-8pjx-jj86-j47p
- alias/CVE-2021-43798
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/references
- agent/softwarecombine
- agent/description
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/event
- agent/tags
- collector/nvd-api
- vendor/grafana
- canonical/grafana grafana
- version/grafana grafana/8.0.1
- version/grafana grafana/8.1.0
- version/grafana grafana/8.2.0
- version/grafana grafana/8.0.0-beta1
- version/grafana grafana/8.0.0-beta2
- version/grafana grafana/8.0.0-beta3
- version/grafana grafana/8.3.0
- package-manager/go