Test ID:	1.3.6.1.4.1.25623.1.0.147272
Category:	Web application abuses
Title:	Grafana 8.0.0-beta1 - 8.3.0 Directory Traversal Vulnerability - Version Check
Summary:	Grafana is prone to a directory traversal vulnerability.
Description:	Summary: Grafana is prone to a directory traversal vulnerability. Vulnerability Insight: Grafana is vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: /public/plugins/<'plugin-id'> where <'plugin-id'> is the plugin ID for any installed plugin. Every Grafana instance comes with pre-installed plugins like the Prometheus plugin or MySQL plugin so multiple URLs are vulnerable for every instance. Vulnerability Impact: An unauthenticated attacker may read arbitrary files. Affected Software/OS: Grafana version 8.0.0-beta1 through 8.3.0. Solution: Update to version 8.0.7, 8.1.8, 8.2.7, 8.3.1 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-43798 https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce http://www.openwall.com/lists/oss-security/2021/12/09/2 http://www.openwall.com/lists/oss-security/2021/12/10/4
Copyright	Copyright (C) 2021 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.