CVE-2021-43815: grafana

csirt@kutim:~/threat-intel/cve/CVE-2021-43815

CVSS 4.3 · Medium EPSS 1,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada grafana. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.

Rincian

Terbit di NVD: 10 Desember 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 1,9% peluang dieksploitasi; lebih tinggi dari 79,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
grafana	grafana	Semua versi sebelum 7.5.12
grafana	grafana	Versi 8.0.0 hingga sebelum 8.3.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www.openwall.com/lists/oss-security/2021/12/10/4 mailing list · patch · advisory pihak ketiga
https://github.com/grafana/grafana/commit/d6ec6f8ad28f0212e584406730f939105ff6c6d3 patch · advisory pihak ketiga
https://github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d patch · advisory pihak ketiga
https://github.com/grafana/grafana/security/advisories/GHSA-7533-c8qv-jm9m patch · advisory pihak ketiga
https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/ patch · advisory pihak ketiga
https://github.com/grafana/grafana/releases/tag/v8.3.2 release notes · advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20220107-0006/ advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.