NetSight
IP …
high8.2Public exploit code

CVE-2020-13379

Server Side Request Forgery in Grafana

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The avatar feature in Grafana (github.com/grafana/grafana/pkg/api/avatar) 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue that allows remote code execution. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on.

Affected packages

EcosystemPackageAffectedFixed in
gogithub.com/grafana/grafana>= 3.0.1, < 6.7.46.7.4

Affected products

VendorProductAffected versions
GrafanaGrafana
from 3.0.1 through 7.0.1
FedoraprojectFedora
Versions 31, 32
NetappE-Series Performance Analyzer
All versions
OpensuseLeap
Version 15.2
OpensuseBackports Sle
Version 15.0

Weakness classification

CWE-918

References