Description

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Remediation

References

CVE-2020-12459

Related Vulnerabilities

Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2021-33333)

MySQL CVE-2017-10311 Vulnerability (CVE-2017-10311)

WordPress Deserialization of Untrusted Data Vulnerability (CVE-2022-21663)

WordPress Plugin Newsletter-Send awesome emails from WordPress Unspecified Vulnerability (4.1.1)

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-16688)

Severity

Medium

Classification

CVE-2020-12459 CWE-200 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities