CVE-2021-43813
CVSS V2 Medium 4
CVSS V3 Medium 4.3
Description
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.
Overview
- CVE ID
- CVE-2021-43813
- Assigner
- security-advisories@github.com
- Vulnerability Status
- Analyzed
- Published Version
- 2021-12-10T18:15:08
- Last Modified Date
- 2022-03-31T16:31:19
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | 1 | OR | 5.0.0 | 7.5.12 |
| cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | 1 | OR | 8.0.0 | 8.3.2 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:S/C:P/I:N/A:N
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- SINGLE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- NONE
- Availability Impact
- NONE
- Base Score
- 4
- Severity
- MEDIUM
- Exploitability Score
- 8
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- LOW
- Availability Impact
- NONE
- Base Score
- 4.3
- Base Severity
- MEDIUM
- Exploitability Score
- 2.8
- Impact Score
- 1.4
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d | Patch Third Party Advisory |
| https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/ | Patch Release Notes Vendor Advisory |
| https://github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2q | Patch Release Notes Third Party Advisory |
| https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-12/ | Release Notes Vendor Advisory |
| https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-2/ | Release Notes Vendor Advisory |
| https://github.com/github/securitylab-vulnerabilities/commit/689fc5d9fd665be4d5bba200a6a433b532172d0f | Broken Link |
| http://www.openwall.com/lists/oss-security/2021/12/10/4 | Mailing List Patch Release Notes Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20220107-0006/ | Third Party Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2021-43813 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43813 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-04-04 00:39:46 | Added to TrackCVE | |||
| 2022-12-06 03:32:39 | 2021-12-10T18:15Z | 2021-12-10T18:15:08 | CVE Published Date | updated |
| 2022-12-06 03:32:39 | 2022-03-31T16:31:19 | CVE Modified Date | updated | |
| 2022-12-06 03:32:39 | Analyzed | Vulnerability Status | updated |