CVE-2020-12459

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 25%
Affected Products (NVD)
VendorProductVersion
grafanagrafana
6.0.0 ≤
𝑥
≤ 6.3.6
𝑥
= Vulnerable software versions
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
grafana
RHEL 8
0:6.7.4-3.el8
fixed
grafana-azure-monitor
RHEL 8
0:6.7.4-3.el8
fixed
grafana-cloudwatch
RHEL 8
0:6.7.4-3.el8
fixed
grafana-elasticsearch
RHEL 8
0:6.7.4-3.el8
fixed
grafana-graphite
RHEL 8
0:6.7.4-3.el8
fixed
grafana-influxdb
RHEL 8
0:6.7.4-3.el8
fixed
grafana-loki
RHEL 8
0:6.7.4-3.el8
fixed
grafana-mssql
RHEL 8
0:6.7.4-3.el8
fixed
grafana-mysql
RHEL 8
0:6.7.4-3.el8
fixed
grafana-opentsdb
RHEL 8
0:6.7.4-3.el8
fixed
grafana-postgres
RHEL 8
0:6.7.4-3.el8
fixed
grafana-prometheus
RHEL 8
0:6.7.4-3.el8
fixed
grafana-stackdriver
RHEL 8
0:6.7.4-3.el8
fixed