logo

Database

Unauthorized access to screen In github.com/grafana/grafana

Description

Grafana world readable configuration files In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2020-124592. NVD-2020-124593. OSV-2020-124594. GCVE-2020-124595. ACCESS-CVE-2020-12459

References

1. https://github.com/grafana/grafana/issues/82832. https://github.com/grafana/grafana/commit/102448040d5132460e3b0013e03ebedec0677e003. https://bugzilla.redhat.com/show_bug.cgi?id=18277654. https://bugzilla.redhat.com/show_bug.cgi?id=18297245. https://lists.fedoraproject.org/archives/list/[email protected]/message/CTQCKJZZYXMCSHJFZZ3YXEO5NUBANGZS6. https://lists.fedoraproject.org/archives/list/[email protected]/message/WEBCIEVSYIDDCA7FTRS2IFUOYLIQU34A7. https://security.netapp.com/advisory/ntap-20200518-00048. https://src.fedoraproject.org/rpms/grafana/c/fab93d67363eb0a9678d9faf160cc88237f26277

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.