GitHub Security Labs notified us that there’s a limited directory traversal attack against Grafana 8.3.1 which allows access to '.md' files. During our internal follow-up investigation, we found an attack allowing access to .csv files. The vulnerable URL path is: '/api/plugins/./markdown/.'

A security issue was found that could allow any users with Editor or Admin permissions in Grafana to read any file that the Grafana process can read from the filesystem. Note, that in order to exploit this you would need to be logged in to the system as a legitimate user with Editor or Admin permissions.

External References:

https://community.grafana.com/t/grafana-5-3-3-and-4-6-5-security-update/11961

A flaw was found in Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

References: https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix/