BDU:2023-00493

BDU

HighConfirmedExploit available

Уязвимость веб-инструмента представления данных Grafana связана с неверным ограничением имени пути к каталогу с ограниченным доступом. Эксп…

CVSS

7.5

High

EPSS

0.00

Published

2023-01-01

Updated

2023-01-01

Description

Уязвимость веб-инструмента представления данных Grafana связана с неверным ограничением имени пути к каталогу с ограниченным доступом. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, читать произвольные файлы с помощью специально созданного HTTP-запроса

Tags · CWE

Pre-auth

Affected products

Grafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs GrafanaGrafana labs Grafana

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Timeline

2023-01-01

Published

2023-01-01

Updated

CVSS 3.1 breakdown

Attack Vector

AV: N

Network (N)

Attack Complexity

AC: L

Low (L)

Privileges Required

PR: N

None (N)

User Interaction

UI: N

None (N)

Scope

S: U

Unchanged (U)

Confidentiality Impact

C: H

High (H)

Integrity Impact

I: N

None (N)

Availability Impact

A: N

None (N)

Exploit indicators

EPSS

0.000 · p0

Known exploited (KEV)

Known exploits — Сканер-ВС

50581

exploitdb · https://www.exploit-db.com/exploits/50581

Enterprise

CVE-2021-43798

github-poc · https://github.com/Okymi-X/CVE-2021-43798

Enterprise

Affected software

Product	Vendor	Status
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked
grafana	grafana labs	Tracked

Source databases

BDU

Related vulnerabilities

CVE-2021-43798

External references

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-43798@https://www.exploit-db.com/exploits/50581@https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/@https://www.cybersecurity-help.cz/vdb/SB2021120803@https://www.exploit-db.com/exploits/50581@https://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html@https://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html@https://www.openwall.com/lists/oss-security/2021/12/09/2@https://www.openwall.com/lists/oss-security/2021/12/10/4@https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce@https://github.com/jas502n/Grafana-CVE-2021-43798@https://www.suse.com/security/cve/CVE-2021-43798.html@http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html