Description

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Remediation

References

CVE-2020-12459

Related Vulnerabilities

WordPress Plugin WP Photo Album Plus Cross-Site Request Forgery (4.8.11)

Artifactory Insufficient Verification of Data Authenticity Vulnerability (CVE-2018-19971)

WordPress Plugin Post Recommendations for WordPress 'api.php' Remote File Include (1.1.2)

WordPress Plugin Developer Tools Arbitrary File Upload (1.1.4)

Craft CMS Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2024-37843)

Severity

Medium

Classification

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2020-12459