CVE-2018-19039

Опубликовано: 13 дек. 2018

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html
http://www.securityfocus.com/bid/105994
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:0747
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0911
Third Party Advisory
https://community.grafana.com/t/grafana-5-3-3-and-4-6-5-security-update/11961
Patch
Vendor Advisory
https://security.netapp.com/advisory/ntap-20190416-0004/
Third Party Advisory
https://www.percona.com/blog/2018/11/20/how-cve-2018-19039-affects-percona-monitoring-and-management/
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html
http://www.securityfocus.com/bid/105994
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:0747
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0911
Third Party Advisory
https://community.grafana.com/t/grafana-5-3-3-and-4-6-5-security-update/11961
Patch
Vendor Advisory
https://security.netapp.com/advisory/ntap-20190416-0004/
Third Party Advisory
https://www.percona.com/blog/2018/11/20/how-cve-2018-19039-affects-percona-monitoring-and-management/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*

Версия до 4.6.5 (исключая)

cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 5.3.3 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:netapp:active_iq_performance_analytics_services:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:storagegrid_webscale_nas_bridge:-:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.0728

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2018-19039

CVSS3: 6.5

ubuntu

почти 8 лет назад

Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.

CVE-2018-19039

CVSS3: 6.5

redhat

почти 8 лет назад

Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.

CVE-2018-19039

CVSS3: 6.5

debian

почти 8 лет назад

Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated ...

GHSA-7vqc-8389-rvvr

CVSS3: 6.5

github

больше 4 лет назад

Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.

ALT-PU-2018-2838

CVSS3: 6.5

altlinux

почти 8 лет назад

ALT-PU-2018-2838: package `grafana` update to version 5.4.2-alt1

EPSS

Процентиль: 94%

0.0728

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-200