CVE-2021-43798

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 88,5%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada grafana. Skor CVSS 3.1 7.5 (High) menurut github.com. Masuk katalog KEV CISA pada 9 Oktober 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

Rincian

Terbit di NVD

7 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

88,5% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Grafana Path Traversal Vulnerability

Masuk KEV

9 Oktober 2025

Tenggat CISA

30 Oktober 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p patch · advisory vendor
• https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/ advisory vendor
• http://www.openwall.com/lists/oss-security/2021/12/09/2 mailing list · patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/12/10/4 mailing list · patch · advisory pihak ketiga
• https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43798 pemerintah AS
• http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html exploit · advisory pihak ketiga · vdb entry
• https://security.netapp.com/advisory/ntap-20211229-0004/ advisory pihak ketiga