The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control…
Priority HIGH 81CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- Partial Red Hat: 11 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.
Why it matters now
EPSS 0.99856 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Partial github.com/grafana/grafana (Go): 6.7.4, 7.0.2Red Hat: 8 advisoriesRed Hat: 11 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/grafana/grafana (Go) | 3.0.1 to before 6.7.4 | 6.7.4 | Patch available | GHSA-wc9w-wvq2-ffm9 |
| — | github.com/grafana/grafana (Go) | 7.0.0 to before 7.0.2 | 7.0.2 | Patch available | GHSA-wc9w-wvq2-ffm9 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/grafana/grafana (Go) Vendor— Affected 3.0.1 to before 6.7.4 Fixed in 6.7.4 Patch available GHSA-wc9w-wvq2-ffm9
- github.com/grafana/grafana (Go) Vendor— Affected 7.0.0 to before 7.0.2 Fixed in 7.0.2 Patch available GHSA-wc9w-wvq2-ffm9
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | 3.0.1 – 7.0.1 | Vulnerable | Grafana |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
| cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* | 15.0 sp1 | Vulnerable | openSUSE |
| cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:* | 15.0 sp2 | Vulnerable | openSUSE |
- cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* Versions 3.0.1 – 7.0.1 Vulnerable ·Grafana
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
- cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* Versions 15.0 sp1 Vulnerable ·openSUSE
- cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:* Versions 15.0 sp2 Vulnerable ·openSUSE
Remediation
- Fix · GHSA-wc9w-wvq2-ffm9 github.com/grafana/grafana (Go) Fixed in 6.7.4 Advisory →
- Fix · GHSA-wc9w-wvq2-ffm9 github.com/grafana/grafana (Go) Fixed in 7.0.2 Advisory →
Red Hat 8 advisories
- RHSA-2021:1518 Released 2021-05-06 · Red Hat rating ImportantRed Hat Ceph Storage 3.3 Security and Bug Fix Update
- Red Hat Ceph Storage 3 MON - ELS ceph-2:12.2.12-139.el7cp, ceph-base-2:12.2.12-139.el7cp, ceph-common-2:12.2.12-139.el7cp +17
- Red Hat Ceph Storage 3 OSD - ELS ceph-2:12.2.12-139.el7cp, ceph-base-2:12.2.12-139.el7cp, ceph-common-2:12.2.12-139.el7cp +16
- Red Hat Ceph Storage 3 Tools - ELS ceph-2:12.2.12-139.el7cp, ceph-ansible-3.2.56-1.el7cp, ceph-base-2:12.2.12-139.el7cp +23
- RHSA-2021:0083 Released 2021-01-12 · Red Hat rating ImportantRed Hat Ceph Storage 4.2 security and bug fix update
- Red Hat Ceph Storage 4.2 Tools rhceph/rhceph-4-dashboard-rhel8
- RHSA-2020:5599 Released 2020-12-17 · Red Hat rating Importantweb-admin-build security and bug fix update
- Red Hat Gluster 3.5 Web Administration on RHEL-7 grafana-5.2.4-3.el7rhgs
Show 5 more Red Hat advisories
- RHSA-2020:2861 Released 2020-07-07 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update
- OpenShift Service Mesh 1.0 servicemesh-grafana-6.2.2-38.el8, servicemesh-grafana-prometheus-6.2.2-38.el8
- RHSA-2020:2792 Released 2020-07-06 · Red Hat rating ModerateOpenShift Container Platform 4.4.11 grafana-container security update
- Red Hat OpenShift Container Platform 4.4 openshift4/ose-grafana
- RHSA-2020:2796 Released 2020-07-01 · Red Hat rating ImportantRed Hat OpenShift Service Mesh servicemesh-grafana security update
- OpenShift Service Mesh 1.1 servicemesh-grafana-6.4.3-11.el8, servicemesh-grafana-prometheus-6.4.3-11.el8
- RHSA-2020:2676 Released 2020-06-23 · Red Hat rating Importantgrafana security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) grafana-6.2.2-6.el8_1, grafana-azure-monitor-6.2.2-6.el8_1, grafana-cloudwatch-6.2.2-6.el8_1 +10
- RHSA-2020:2641 Released 2020-06-22 · Red Hat rating Importantgrafana security update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-6.3.6-2.el8_2, grafana-azure-monitor-6.3.6-2.el8_2, grafana-cloudwatch-6.3.6-2.el8_2 +10
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 3 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 1.0 | Fixed | RHSA-2020:2861 |
| OpenShift Service Mesh 1.1 | Fixed | RHSA-2020:2796 |
| Red Hat Ceph Storage 3 MON - ELS | Fixed | RHSA-2021:1518 |
| Red Hat Ceph Storage 3 OSD - ELS | Fixed | RHSA-2021:1518 |
| Red Hat Ceph Storage 3 Tools - ELS | Fixed | RHSA-2021:1518 |
| Red Hat Ceph Storage 4.2 Tools | Fixed | RHSA-2021:0083 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:2641 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.1) | Fixed | RHSA-2020:2676 |
| Red Hat Gluster 3.5 Web Administration on RHEL-7 | Fixed | RHSA-2020:5599 |
| Red Hat OpenShift Container Platform 4.4 | Fixed | RHSA-2020:2792 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | — |
Not affected: 3 products
- Red Hat Ceph Storage 4.2 Tools
- Red Hat Gluster 3.5 Web Administration Node Agent on RHEL-7
- Red Hat Gluster 3.5 Web Administration on RHEL-7
Timeline
- 2026-10-02 Threatist record created from CVE-2020-13379
- 2026-10-03 Alias added: GHSA-wc9w-wvq2-ffm9
- 2026-10-30 Fix available: Red Hat OpenShift Container Platform 4.6 · Red Hat
References
Exploit 3
Advisory 14
- https://community.grafana.com/t/release-notes-v6-7-x/27119
- http://www.openwall.com/lists/oss-security/2020/06/03/4
- https://community.grafana.com/t/grafana-7-0-2-and-6-7-4-security-update/31408
- https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/
- https://community.grafana.com/t/release-notes-v7-0-x/29381
- https://security.netapp.com/advisory/ntap-20200608-0006/
- [oss-security] 20200609 Re: Grafana 6.7.4 and 7.0.2 released with fix for CVE-2020-13379
- FEDORA-2020-e6e81a03d6
- FEDORA-2020-a09e5be0be
- openSUSE-SU-2020:0892
- openSUSE-SU-2020:1105
- openSUSE-SU-2020:1611
- openSUSE-SU-2020:1646
- https://nvd.nist.gov/vuln/detail/CVE-2020-13379
Other 31
- [ambari-issues] 20200903 [jira] [Assigned] (AMBARI-25547) Update Grafana version to 6.7.4 to avoid CVE-2020-13379
- [ambari-issues] 20200903 [jira] [Created] (AMBARI-25547) Update Grafana version to 6.7.4 to avoid CVE-2020-13379
- [ambari-issues] 20210121 [jira] [Updated] (AMBARI-25547) Update Grafana version to 6.7.4 to avoid CVE-2020-13379
- [ambari-dev] 20210121 [GitHub] [ambari] payert opened a new pull request #3279: AMBARI-25547 Update Grafana version to 6.7.4 to avoid CVE-2020-13379
- [ambari-dev] 20210121 [GitHub] [ambari] payert commented on a change in pull request #3279: AMBARI-25547 Update Grafana version to 6.7.4 to avoid CVE-2020-13379
- [ambari-dev] 20210121 [GitHub] [ambari] dvitiiuk commented on a change in pull request #3279: AMBARI-25547 Update Grafana version to 6.7.4 to avoid CVE-2020-13379
- [ambari-dev] 20210122 [GitHub] [ambari] payert commented on a change in pull request #3279: AMBARI-25547 Update Grafana version to 6.7.4 to avoid CVE-2020-13379
- [ambari-dev] 20210122 [GitHub] [ambari] payert opened a new pull request #3279: AMBARI-25547 Update Grafana version to 6.7.4 to avoid CVE-2020-13379
- [ambari-dev] 20210122 [GitHub] [ambari] dvitiiuk commented on a change in pull request #3279: AMBARI-25547 Update Grafana version to 6.7.4 to avoid CVE-2020-13379
- [ambari-commits] 20210125 [ambari] branch branch-2.7 updated: AMBARI-25547 Update Grafana version to 6.7.4 to avoid CVE-2020-13379 (#3279)
- [ambari-dev] 20210125 [GitHub] [ambari] payert merged pull request #3279: AMBARI-25547 Update Grafana version to 6.7.4 to avoid CVE-2020-13379
- [ambari-issues] 20210127 [jira] [Resolved] (AMBARI-25547) Update Grafana version to 6.7.4 to avoid CVE-2020-13379
- https://github.com/grafana/grafana/commit/ba953be95f0302c2ea80d23f1e5f2c1847365192
- https://www.exploit-db.com/exploits/48638
- https://security.netapp.com/advisory/ntap-20200608-0006
- https://mostwanted002.cf/post/grafanados
- https://lists.fedoraproject.org/archives/list/[email protected]/message/O2KSCCGKNEENZN3DW7TSPFBBUZH3YZXZ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/EEKSZ6GE4EDOFZ23NGYWOCMD6O4JF5SO
- https://lists.apache.org/thread.html/rff71126fa7d9f572baafb9be44078ad409c85d2c0f3e26664f1ef5a2@%3Cdev.ambari.apache.org%3E
- https://lists.apache.org/thread.html/re7c4b251b52f49ba6ef752b829bca9565faaf93d03206b1db6644d31@%3Cdev.ambari.apache.org%3E
- https://lists.apache.org/thread.html/re75f59639f3bc1d14c7ab362bc4485ade84f3c6a3c1a03200c20fe13@%3Cissues.ambari.apache.org%3E
- https://lists.apache.org/thread.html/rd0fd283e3844b9c54cd5ecc92d966f96d3f4318815bbf3ac41f9c820@%3Ccommits.ambari.apache.org%3E
- https://lists.apache.org/thread.html/rba0247a27be78bd14046724098462d058a9969400a82344b3007cf90@%3Cdev.ambari.apache.org%3E
- https://lists.apache.org/thread.html/rad99b06d7360a5cf6e394afb313f8901dcd4cb777aee9c9197b3b23d@%3Cdev.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r984c3b42a500f5a6a89fbee436b9432fada5dc27ebab04910aafe4da@%3Cissues.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r6bb57124a21bb638f552d81650c66684e70fc1ff9f40b6a8840171cd@%3Cissues.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r6670a6c29044bcb77d4e5d165b5bd13fffe37b84caa5d6471b13b3a2@%3Cdev.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r40f0a97b6765de6b8938bc212ee9dfb5101e9efa48bcbbdec02b2a60@%3Cissues.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r093b405a49fd31efa0d949ac1a887101af1ca95652a66094194ed933@%3Cdev.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r0928ee574281f8b6156e0a6d0291bfc27100a9dd3f9b0177ece24ae4@%3Cdev.ambari.apache.org%3E
- https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix
Sources
- CVE-2020-13379 · CVE Program
- CVE-2020-13379 · NVD
- FIRST EPSS
- GHSA-wc9w-wvq2-ffm9 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-13379 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences