VDB
RHSA-2020%3A2792
RHSA-2020%3A2792
PUBLISHED
CVSS 8.199999809265137 HIGH
An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer dereference vulnerability. This flaw allows an attacker to gain information about the network that Grafana is running on, or cause a segmentation fault, resulting in a denial of service.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-grafana@sha256:963fe01272ee5fe6deeafa453087f981733c3277944f6d103fd246ea6e21e1a6_amd64 as a component of Red Hat OpenShift Container Platform 4.4 | openshift4/ose-grafana@sha256:963fe01272ee5fe6deeafa453087f981733c3277944f6d103fd246ea6e21e1a6_amd64 |
| Red Hat | openshift4/ose-grafana@sha256:90ad6cd473e4498fe55ddcd4d169f98233fcb1b5091a665fdc2ca717b1d5af30_s390x as a component of Red Hat OpenShift Container Platform 4.4 | openshift4/ose-grafana@sha256:90ad6cd473e4498fe55ddcd4d169f98233fcb1b5091a665fdc2ca717b1d5af30_s390x |
| Red Hat | openshift4/ose-grafana@sha256:fab09ff63ee4cf635faba041aceb9700bef5647776a10b38721fd424cc9bcc85_ppc64le as a component of Red Hat OpenShift Container Platform 4.4 | openshift4/ose-grafana@sha256:fab09ff63ee4cf635faba041aceb9700bef5647776a10b38721fd424cc9bcc85_ppc64le |
Timeline
- Jul 6, 2020 CVE Published
- Feb 28, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2020:2792 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1843640 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2792.json advisory
- https://access.redhat.com/security/cve/CVE-2020-13379 advisory
- https://www.cve.org/CVERecord?id=CVE-2020-13379 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-13379 advisory
- https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/ advisory
- https://www.openwall.com/lists/oss-security/2020/06/09/2/ advisory