The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOSing Grafana via SegFault.
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Grafana | Grafana | 3.0.1 (including) | 7.0.1 (including) |
| OpenShift Service Mesh 1.0 | RedHat | servicemesh-grafana-0:6.2.2-38.el8 | * |
| OpenShift Service Mesh 1.1 | RedHat | servicemesh-grafana-0:6.4.3-11.el8 | * |
| Red Hat Ceph Storage 3 - ELS | RedHat | ceph-2:12.2.12-139.el7cp | * |
| Red Hat Ceph Storage 3 - ELS | RedHat | ceph-ansible-0:3.2.56-1.el7cp | * |
| Red Hat Ceph Storage 3 - ELS | RedHat | cephmetrics-0:2.0.10-1.el7cp | * |
| Red Hat Ceph Storage 3 - ELS | RedHat | grafana-0:5.2.4-3.el7cp | * |
| Red Hat Ceph Storage 3 - ELS | RedHat | tcmu-runner-0:1.4.0-3.el7cp | * |
| Red Hat Ceph Storage 4.2 | RedHat | rhceph/rhceph-4-dashboard-rhel8:4-22 | * |
| Red Hat Enterprise Linux 8 | RedHat | grafana-0:6.3.6-2.el8_2 | * |
| Red Hat Enterprise Linux 8.1 Extended Update Support | RedHat | grafana-0:6.2.2-6.el8_1 | * |
| Red Hat Gluster Storage 3.5 for RHEL 7 | RedHat | grafana-0:5.2.4-3.el7rhgs | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-grafana:v4.4.0-202006290400.p0 | * |
| Grafana | Ubuntu | trusty | * |
| Grafana | Ubuntu | xenial | * |