CVE-2021-43798

high-risk
Published 2021-12-07

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

Do I need to act?

!
94.4% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
50581
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (5)

Affected Vendors

Grafana

References (17)

Third Party Advisory http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html
Exploit http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Ar...
Mailing List http://www.openwall.com/lists/oss-security/2021/12/09/2
Mailing List http://www.openwall.com/lists/oss-security/2021/12/10/4
Patch https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545...
Patch https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
Vendor Advisory https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-dir...
Third Party Advisory https://security.netapp.com/advisory/ntap-20211229-0004/
Third Party Advisory http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html
Exploit http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Ar...
Mailing List http://www.openwall.com/lists/oss-security/2021/12/09/2
Mailing List http://www.openwall.com/lists/oss-security/2021/12/10/4
Patch https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545...
Patch https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
Vendor Advisory https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-dir...
Third Party Advisory https://security.netapp.com/advisory/ntap-20211229-0004/
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-...
65
/ 100
high-risk
Severity 26/34 · High
Exploitability 27/34 · High
Exposure 12/34 · Low