NVD Vulnerability Detail

CVE-2020-12459

Summary	In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
Publication Date	April 30, 2020, 1:15 a.m.
Registration Date	Jan. 26, 2021, 11:51 a.m.
Last Update	Nov. 21, 2024, 1:59 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:grafana:grafana::::::::		6.0.0	6.3.6

Related information, measures and tools

No	URL	タグ
1	https://access.redhat.com/security/cve/CVE-2020-12459	Third Party Advisory
2	https://bugzilla.redhat.com/show_bug.cgi?id=1829724	Issue Tracking Third Party Advisory
3	https://github.com/grafana/grafana/issues/8283	Vendor Advisory
4	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTQCKJZZYXMCSHJFZZ3YXEO5NUBANGZS/
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WEBCIEVSYIDDCA7FTRS2IFUOYLIQU34A/
6	https://security.netapp.com/advisory/ntap-20200518-0004/	Third Party Advisory
7	https://src.fedoraproject.org/rpms/grafana/c/fab93d67363eb0a9678d9faf160cc88237f26277	Patch Third Party Advisory
8	https://access.redhat.com/security/cve/CVE-2020-12459	Third Party Advisory
9	https://src.fedoraproject.org/rpms/grafana/c/fab93d67363eb0a9678d9faf160cc88237f26277	Patch Third Party Advisory
10	https://security.netapp.com/advisory/ntap-20200518-0004/	Third Party Advisory
11	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WEBCIEVSYIDDCA7FTRS2IFUOYLIQU34A/
12	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTQCKJZZYXMCSHJFZZ3YXEO5NUBANGZS/
13	https://github.com/grafana/grafana/issues/8283	Vendor Advisory
14	https://bugzilla.redhat.com/show_bug.cgi?id=1829724	Issue Tracking Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-732	重要なリソースに対する不適切なパーミッションの割り当て	https://cwe.mitre.org/data/definitions/732.html

JVN Vulnerability Information

Grafana における情報漏えいに関する脆弱性

Title	Grafana における情報漏えいに関する脆弱性
Summary	Grafana には、情報漏えいに関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	April 23, 2020, midnight
Registration Date	May 29, 2020, 6:12 p.m.
Last Update	May 29, 2020, 6:12 p.m.

Affected System

Grafana Labs

Grafana 6.3.6 までの 6.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-12459	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12459
National Vulnerability Database (NVD)
2	CVE-2020-12459	https://nvd.nist.gov/vuln/detail/CVE-2020-12459
関連文書
3	CVE-2020-12459	https://access.redhat.com/security/cve/CVE-2020-12459

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
GitHub
1	[Bug] Wrong permissions in grafana package for grafana.db #8283	https://github.com/grafana/grafana/issues/8283

Change Log

No	Changed Details	Date of change
1	[2020年05月29日] 掲載	May 29, 2020, 6:12 p.m.