Description

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

Remediation

References

CVE-2020-12458

Related Vulnerabilities

ZenCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2005-3996)

WordPress Plugin WordPress File Monitor Cross-Site Scripting (2.3.3)

WordPress Plugin Slimstat Analytics SQL Injection (4.9.3.3)

WordPress Plugin WordPress File Upload Multiple Unspecified Vulnerabilities (3.10.0)

Python Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') Vulnerability (CVE-2016-5699)

Severity

Medium

Classification

CVE-2020-12458 CWE-312 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities