CVE-2021-43798

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-43798
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43798.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-43798
Aliases
Downstream
Related
Published
2021-12-07T19:15:07.633Z
Modified
2026-04-10T04:40:26.151594Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: <grafana_host_url>/public/plugins//, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

References

Affected packages

Git / github.com/grafana/grafana

Affected ranges

Type
GIT
Repo
https://github.com/grafana/grafana
Events
Introduced
8849243d272e57fd3f7a50c0e02f6a4f00bbeb04
Fixed
822ff7595e4a7851076d72681e98d9192361df31
Introduced
62e720c06ba5f26a73cdecf1dea59031046f1ac1
Fixed
52edcff798be02905898c345399ceb0c36276e09
Introduced
d7f71e9eaec57995d4537f758e300b31650d23ee
Fixed
d2cccfe91ec24c76eb4e5de60a6e6372207d9b4e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
84203aaff8b01727813044d580270f03319ca8eb
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9d4c71920555f3ee76b1d8ed6f1b1a5d2885afeb
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
10cdbad0ad3018ae706f5e7a1c7d2ccc5dd18221
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
914fcedb72c5e1bd6752f8f311b14df9cc7f7281
Fixed
c798c0e958d15d9cc7f27c72113d572fa58545ce
Database specific 
{
    "versions": [
        {
            "introduced": "8.0.1"
        },
        {
            "fixed": "8.0.7"
        },
        {
            "introduced": "8.1.0"
        },
        {
            "fixed": "8.1.8"
        },
        {
            "introduced": "8.2.0"
        },
        {
            "fixed": "8.2.7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0.0-beta1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0.0-beta2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0.0-beta3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.3.0"
        }
    ]
}

Affected versions

v1.*
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.6.0
v1.6.1
v1.7.0-rc1
v1.9.0
v1.9.0-rc1
v1.9.1
v2.*
v2.0.0-beta1
v2.0.0-beta3
v2.0.1
v2.0.2
v2.5.0
v2.6.0
v2.6.0-beta1
v3.*
v3.0.0-beta6
v3.0.0-beta7
v3.0.1
v3.0.2
v3.1.0-beta1
v4.*
v4.4.0
v4.5.0
v4.5.0-beta1
v4.6.0-beta1
v5.*
v5.,2.4
v5.0.0
v5.0.0-beta1
v5.0.0-beta2
v5.0.0-beta3
v5.0.0-beta4
v5.0.0-beta5
v6.*
v6.0.0-beta1
v6.5
v8.*
v8.0.0-beta1
v8.0.0-beta2
v8.0.0-beta3
v8.0.1
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.0.6
v8.1.0
v8.1.1
v8.1.2
v8.1.3
v8.1.4
v8.1.7
v8.2.0
v8.2.1
v8.2.2
v8.2.5
v8.2.6
v8.3.0
v8.3.0-beta2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43798.json"