Path traversal in Grafana - CVE-2021-43813

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU64273

Path traversal in Grafana - CVE-2021-43813

Published: June 14, 2022


Vulnerability identifier: #VU64273
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-43813
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.


Affected software

Grafana
Arch Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Manager Client Tools Beta for SLE Micro
SUSE Enterprise Storage
HPE Helion Openstack
SUSE OpenStack Cloud
Red Hat Enterprise Linux for Power, little endian
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Anolis OS
SUSE Manager Tools
SUSE Manager Client Tools Beta for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
Fedora
OpenShift Service Mesh
IBM Watson Machine Learning Accelerator
Red Hat Ceph Storage
firewalld-prometheus-config
kiwi-desc-saltboot
dracut-saltboot
golang-github-QubitProducts-exporter_exporter
prometheus-postgres_exporter
golang-github-prometheus-promu
prometheus-blackbox_exporter-debuginfo
prometheus-blackbox_exporter
golang-github-prometheus-alertmanager
system-user-prometheus
system-user-grafana
golang-github-lusitaniae-apache_exporter
golang-github-lusitaniae-apache_exporter-debuginfo
zypp-plugin-spacewalk
python2-zypp-plugin-spacewalk
python3-zypp-plugin-spacewalk
supportutils-plugin-salt
golang-github-prometheus-node_exporter
golang-github-boynux-squid_exporter
golang-github-boynux-squid_exporter-debuginfo
python2-hwdata
python3-hwdata
ansible-doc
ansible
golang-github-prometheus-prometheus
python3-mgr-virtualization-host
python3-mgr-virtualization-common
mgr-virtualization-host
spacewalk-oscap
python3-spacewalk-oscap
python3-mgr-push
mgr-push
python3-suseRegisterInfo
suseRegisterInfo
python3-spacewalk-koan
spacewalk-koan
python3-rhnlib
mgr-cfg-management
python3-mgr-cfg-management
python3-mgr-cfg-client
mgr-cfg
mgr-cfg-actions
mgr-cfg-client
python3-mgr-cfg-actions
python3-mgr-cfg
python3-mgr-osad
python3-mgr-osa-common
mgr-osad
spacecmd
spacewalk-check
spacewalk-client-setup
python3-spacewalk-check
python3-spacewalk-client-setup
python3-spacewalk-client-tools
spacewalk-client-tools
python2-uyuni-common-libs
python2-mgr-virtualization-host
python2-mgr-push
python2-mgr-virtualization-common
supportutils-plugin-susemanager-client
python2-spacewalk-oscap
python2-rhnlib
python2-spacewalk-koan
spacewalk-remote-utils
python2-suseRegisterInfo
python3-uyuni-common-libs
mgr-custom-info
python2-mgr-cfg-management
python2-mgr-cfg-client
python2-mgr-cfg-actions
python2-mgr-cfg
python2-mgr-osa-common
python2-mgr-osad
mgr-daemon
python2-spacewalk-client-tools
python2-spacewalk-client-setup
python2-spacewalk-check
uyuni-proxy-systemd-services
python3-pyvmomi
grafana
grafana-debuginfo
grafana (Red Hat package)
salt-minion
salt-doc
salt
python3-salt
python2-salt
salt-zsh-completion
salt-bash-completion
salt-fish-completion
salt-syndic
salt-standalone-formulas-configuration
salt-ssh
salt-proxy
salt-master
salt-cloud
salt-api

How to mitigate CVE-2021-43813

Install update from vendor's website.

Grafana - addressed in versions 7.5.12, 8.3.2
OpenShift Service Mesh - update to 2.1.3
IBM Watson Machine Learning Accelerator - update to 3.0.0
firewalld-prometheus-config - update to 0.1-159000.6.33.1
kiwi-desc-saltboot - addressed in versions 0.1.1639488226.7c9eab9-4.12.1, 0.1.1687520761.cefb248-4.15.2
dracut-saltboot - update to 0.1.1681904360.84ef141-159000.3.30.1
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-1.6.1, 0.4.0-4.6.2, 0.4.0-159000.4.6.1
prometheus-postgres_exporter - addressed in versions 0.10.0-1.8.2, 0.10.0-150000.1.3.1, 0.10.1-3.6.4, 0.10.1-159000.3.6.1
golang-github-prometheus-promu - update to 0.14.0-4.12.2
prometheus-blackbox_exporter-debuginfo - addressed in versions 0.19.0-1.8.2, 0.24.0-3.6.3
prometheus-blackbox_exporter - addressed in versions 0.19.0-1.8.2, 0.24.0-3.6.3, 0.24.0-159000.3.6.1
golang-github-prometheus-alertmanager - addressed in versions 0.23.0-1.12.3, 0.26.0-4.12.4
system-user-prometheus - update to 1.0.0-3.7.2
system-user-grafana - update to 1.0.0-3.7.2
golang-github-lusitaniae-apache_exporter - addressed in versions 1.0.0-4.12.4, 1.0.0-159000.4.12.1
golang-github-lusitaniae-apache_exporter-debuginfo - update to 1.0.0-159000.4.12.1
zypp-plugin-spacewalk - addressed in versions 1.0.11-33.18.1, 1.0.11-159000.6.18.3
python2-zypp-plugin-spacewalk - update to 1.0.11-33.18.1
python3-zypp-plugin-spacewalk - update to 1.0.11-159000.6.18.3
supportutils-plugin-salt - addressed in versions 1.2.0-6.16.1, 1.2.2-9.9.2, 1.2.2-159000.5.9.1
golang-github-prometheus-node_exporter - addressed in versions 1.3.0-1.15.3, 1.5.0-4.15.4
golang-github-boynux-squid_exporter - addressed in versions 1.6-4.9.2, 1.6-159000.4.9.1
golang-github-boynux-squid_exporter-debuginfo - update to 1.6-159000.4.9.1
python2-hwdata - addressed in versions 2.3.5-12.9.1, 2.3.5-15.9.1, 2.3.5-15.12.2
python3-hwdata - addressed in versions 2.3.5-159000.5.10.3, 2.3.5-159000.5.13.1
ansible-doc - addressed in versions 2.9.21-159000.3.6.2, 2.9.27-159000.3.9.1
ansible - addressed in versions 2.9.21-159000.3.6.2, 2.9.27-159000.3.9.1
golang-github-prometheus-prometheus - addressed in versions 2.45.0-4.33.3, 2.45.0-159000.6.33.1
python3-mgr-virtualization-host - addressed in versions 4.2.4-150000.1.26.1, 4.3.2-159000.4.12.3
python3-mgr-virtualization-common - addressed in versions 4.2.4-150000.1.26.1, 4.3.2-159000.4.12.3
mgr-virtualization-host - addressed in versions 4.2.4-150000.1.26.1, 4.3.2-4.12.2, 4.3.2-159000.4.12.3, 4.3.5-1.29.3
spacewalk-oscap - addressed in versions 4.2.4-150000.3.18.1, 4.3.2-22.12.1, 4.3.2-159000.6.12.3, 4.3.5-19.27.1
python3-spacewalk-oscap - addressed in versions 4.2.4-150000.3.18.1, 4.3.2-159000.6.12.3
python3-mgr-push - addressed in versions 4.2.5-150000.1.18.2, 4.3.2-159000.4.12.4, 5.0.1-159000.4.21.1
mgr-push - addressed in versions 4.2.5-150000.1.18.2, 4.3.2-4.12.2, 4.3.2-159000.4.12.4, 4.3.4-1.21.4, 5.0.1-4.21.4, 5.0.1-159000.4.21.1
python3-suseRegisterInfo - addressed in versions 4.2.6-150000.3.21.1, 4.3.2-159000.6.18.3
suseRegisterInfo - addressed in versions 4.2.6-150000.3.21.1, 4.3.2-28.18.1, 4.3.2-159000.6.18.3, 4.3.3-25.27.3
python3-spacewalk-koan - addressed in versions 4.2.6-150000.3.27.1, 4.3.2-159000.6.12.3
spacewalk-koan - addressed in versions 4.2.6-150000.3.27.1, 4.3.2-27.12.1, 4.3.2-159000.6.12.3, 4.3.5-24.33.3
python3-rhnlib - addressed in versions 4.2.6-150000.3.34.1, 4.3.2-159000.6.21.3, 5.0.1-159000.6.30.1
mgr-cfg-management - addressed in versions 4.2.8-150000.1.24.1, 4.3.3-4.18.2, 4.3.4-159000.4.20.2, 4.3.6-1.27.4
python3-mgr-cfg-management - addressed in versions 4.2.8-150000.1.24.1, 4.3.4-159000.4.20.2
python3-mgr-cfg-client - addressed in versions 4.2.8-150000.1.24.1, 4.3.4-159000.4.20.2
mgr-cfg - addressed in versions 4.2.8-150000.1.24.1, 4.3.3-4.18.2, 4.3.4-159000.4.20.2, 4.3.6-1.27.4
mgr-cfg-actions - addressed in versions 4.2.8-150000.1.24.1, 4.3.3-4.18.2, 4.3.4-159000.4.20.2, 4.3.6-1.27.4
mgr-cfg-client - addressed in versions 4.2.8-150000.1.24.1, 4.3.3-4.18.2, 4.3.4-159000.4.20.2, 4.3.6-1.27.4
python3-mgr-cfg-actions - addressed in versions 4.2.8-150000.1.24.1, 4.3.4-159000.4.20.2
python3-mgr-cfg - addressed in versions 4.2.8-150000.1.24.1, 4.3.4-159000.4.20.2
python3-mgr-osad - addressed in versions 4.2.8-150000.1.36.1, 4.3.3-159000.4.21.4
python3-mgr-osa-common - addressed in versions 4.2.8-150000.1.36.1, 4.3.3-159000.4.21.4
mgr-osad - addressed in versions 4.2.8-150000.1.36.1, 4.3.3-4.21.2, 4.3.3-159000.4.21.4, 4.3.6-1.39.4
spacecmd - addressed in versions 4.2.16-150000.3.77.1, 4.3.5-41.30.1, 4.3.5-159000.6.30.3, 4.3.11-38.103.3, 5.0.1-41.42.3, 5.0.1-159000.6.42.1
spacewalk-check - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-55.36.2, 4.3.5-159000.6.36.5, 4.3.9-52.71.3, 5.0.1-159000.6.48.1
spacewalk-client-setup - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-55.36.2, 4.3.5-159000.6.36.5, 4.3.9-52.71.3, 5.0.1-159000.6.48.1
python3-spacewalk-check - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-159000.6.36.5, 5.0.1-159000.6.48.1
python3-spacewalk-client-setup - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-159000.6.36.5, 5.0.1-159000.6.48.1
python3-spacewalk-client-tools - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-159000.6.36.5, 5.0.1-159000.6.48.1
spacewalk-client-tools - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-55.36.2, 4.3.5-159000.6.36.5, 4.3.9-52.71.3, 5.0.1-159000.6.48.1
python2-uyuni-common-libs - addressed in versions 4.3.2-3.24.1, 4.3.4-1.21.3, 5.0.1-3.33.3
python2-mgr-virtualization-host - addressed in versions 4.3.2-4.12.2, 4.3.5-1.29.3
python2-mgr-push - addressed in versions 4.3.2-4.12.2, 4.3.4-1.21.4, 5.0.1-4.21.4
python2-mgr-virtualization-common - addressed in versions 4.3.2-4.12.2, 4.3.5-1.29.3
supportutils-plugin-susemanager-client - addressed in versions 4.3.2-6.24.1, 5.0.1-9.15.2, 5.0.1-159000.6.15.1
python2-spacewalk-oscap - addressed in versions 4.3.2-22.12.1, 4.3.5-19.27.1
python2-rhnlib - addressed in versions 4.3.2-24.21.1, 4.3.4-21.43.3, 5.0.1-24.30.3
python2-spacewalk-koan - addressed in versions 4.3.2-27.12.1, 4.3.5-24.33.3
spacewalk-remote-utils - addressed in versions 4.3.2-27.12.2, 4.3.2-159000.6.12.3, 4.3.3-24.24.3
python2-suseRegisterInfo - addressed in versions 4.3.2-28.18.1, 4.3.3-25.27.3
python3-uyuni-common-libs - addressed in versions 4.3.2-159000.3.24.4, 5.0.1-159000.3.33.1
mgr-custom-info - addressed in versions 4.3.3-1.18.1, 4.3.3-4.12.1, 4.3.3-159000.4.12.3
python2-mgr-cfg-management - addressed in versions 4.3.3-4.18.2, 4.3.6-1.27.4
python2-mgr-cfg-client - addressed in versions 4.3.3-4.18.2, 4.3.6-1.27.4
python2-mgr-cfg-actions - addressed in versions 4.3.3-4.18.2, 4.3.6-1.27.4
python2-mgr-cfg - addressed in versions 4.3.3-4.18.2, 4.3.6-1.27.4
python2-mgr-osa-common - addressed in versions 4.3.3-4.21.2, 4.3.6-1.39.4
python2-mgr-osad - addressed in versions 4.3.3-4.21.2, 4.3.6-1.39.4
mgr-daemon - update to 4.3.4-1.32.3
python2-spacewalk-client-tools - addressed in versions 4.3.5-55.36.2, 4.3.9-52.71.3
python2-spacewalk-client-setup - addressed in versions 4.3.5-55.36.2, 4.3.9-52.71.3
python2-spacewalk-check - addressed in versions 4.3.5-55.36.2, 4.3.9-52.71.3
uyuni-proxy-systemd-services - update to 5.0.1-159000.3.9.1
python3-pyvmomi - update to 6.7.3-159000.3.6.1
grafana - addressed in versions 7.5.11-2, 7.5.15-3
grafana-debuginfo - addressed in versions 7.5.11-2, 7.5.15-3
grafana (Red Hat package) - update to 7.5.11-2.el8
grafana - update to 7.5.11-2.0.1
grafana - addressed in versions 7.5.11-3.fc34, 7.5.11-3.fc35
grafana - addressed in versions 7.5.12-1.27.1, 7.5.12-4.18.1, 7.5.12-150100.3.9.1, 7.5.12-159000.4.18.3, 8.3.5-1.30.3, 8.3.5-150000.1.30.1, 9.5.8-4.21.2, 9.5.8-159000.4.24.1
grafana - update to 8.3.1-1
grafana-debuginfo - addressed in versions 8.3.5-150000.1.30.1, 9.5.8-159000.4.24.1
salt-minion - addressed in versions 3000-49.41.3, 3003.3-159000.8.47.2
salt-doc - addressed in versions 3000-49.41.3, 3003.3-159000.8.47.2
salt - addressed in versions 3000-49.41.3, 3003.3-159000.8.47.2
python3-salt - addressed in versions 3000-49.41.3, 3003.3-159000.8.47.2
python2-salt - update to 3000-49.41.3
salt-zsh-completion - update to 3003.3-159000.8.47.2
salt-bash-completion - update to 3003.3-159000.8.47.2
salt-fish-completion - update to 3003.3-159000.8.47.2
salt-syndic - update to 3003.3-159000.8.47.2
salt-standalone-formulas-configuration - update to 3003.3-159000.8.47.2
salt-ssh - update to 3003.3-159000.8.47.2
salt-proxy - update to 3003.3-159000.8.47.2
salt-master - update to 3003.3-159000.8.47.2
salt-cloud - update to 3003.3-159000.8.47.2
salt-api - update to 3003.3-159000.8.47.2

External References

Related Security Bulletins