CVE-2020-12459

Katalog CVE

CVSS 5.5 · Medium EPSS 0,32%

Kerentanan Incorrect Permission Assignment for Critical Resource pada grafana, fedoraproject fedora. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Rincian

Terbit di NVD

29 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grafana/grafana/issues/8283 advisory vendor
• https://src.fedoraproject.org/rpms/grafana/c/fab93d67363eb0a9678d9faf160cc88237f26277 patch · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2020-12459 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=1829724 issue tracking · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200518-0004/ advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTQCKJZZYXMCS...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WEBCIEVSYIDDC...