CVE-2022-32275

7.5

HIGHCVSS v3

Published

June 6, 2022

CVSS v2

5 MEDIUM

Affected

6 projects

Assigned by

MITRE

Severity scale

010

Description

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content

grafana/grafana

GitHubThe open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.

= 8.4.3NVD

grafana/grafana

Docker HubThe official Grafana docker container

= 8.4.3NVD

Grafana

More on this CVE

NVD↗GitHub Advisory↗

ChocolateyGrafana is an open source, feature rich metrics dashboard and graph editor for Graphite, Elasticsearch, OpenTSDB, Prometheus and InfluxDB. **Please Note**: This is an automatically updated package. If you find it is out of date by more than a day or two, please contact the maintainer(s) and let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.

= 8.4.3NVD

grafana

Python Package Indexgrafana

= 8.4.3NVD

grafana

RubyGemsA simple wrapper for the Grafana HTTP API

= 8.4.3NVD

grafana

NPMThis is a placeholder Grafana.com project for @types/grafana

= 8.4.3NVD

Security Advisories

CVE-2022-32275

Description

More on this CVE