Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2020-13379

Server-Side Request Forgery (SSRF)

Published: Jun 03, 2020 | Modified: Nov 21, 2024
CVSS 3.x
8.2
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS 2.x
6.4 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:P
RedHat/V2
RedHat/V3
8.2 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2020-13379
CWEhttps://cwe.mitre.org/data/definitions/918.html

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOSing Grafana via SegFault.

Weakness

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected Software

NameVendorStart VersionEnd Version
GrafanaGrafana3.0.1 (including)7.0.1 (including)
OpenShift Service Mesh 1.0RedHatservicemesh-grafana-0:6.2.2-38.el8*
OpenShift Service Mesh 1.1RedHatservicemesh-grafana-0:6.4.3-11.el8*
Red Hat Ceph Storage 3 - ELSRedHatceph-2:12.2.12-139.el7cp*
Red Hat Ceph Storage 3 - ELSRedHatceph-ansible-0:3.2.56-1.el7cp*
Red Hat Ceph Storage 3 - ELSRedHatcephmetrics-0:2.0.10-1.el7cp*
Red Hat Ceph Storage 3 - ELSRedHatgrafana-0:5.2.4-3.el7cp*
Red Hat Ceph Storage 3 - ELSRedHattcmu-runner-0:1.4.0-3.el7cp*
Red Hat Ceph Storage 4.2RedHatrhceph/rhceph-4-dashboard-rhel8:4-22*
Red Hat Enterprise Linux 8RedHatgrafana-0:6.3.6-2.el8_2*
Red Hat Enterprise Linux 8.1 Extended Update SupportRedHatgrafana-0:6.2.2-6.el8_1*
Red Hat Gluster Storage 3.5 for RHEL 7RedHatgrafana-0:5.2.4-3.el7rhgs*
Red Hat OpenShift Container Platform 4.4RedHatopenshift4/ose-grafana:v4.4.0-202006290400.p0*
GrafanaUbuntutrusty*
GrafanaUbuntuxenial*

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use