Grafana Arbitrary File Read
Date: 2024-01
Affected: go/github.com/grafana/grafana
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2019-19499
CWE: CWE-200
CWE-22
CWE-89
CVSS: 6.2 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P)

Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.


Mitigations:

Architectural layers (MAESTRO):