CVE-2019-19499
grafana: arbitrary file read via MySQL data source
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.
Grafana versiones anteriores a 6.4.3 incluyéndola, presenta una vulnerabilidad de Lectura Arbitraria de Archivos, que podría ser explotada por un atacante autenticado que tiene privilegios para modificar las configuraciones de la fuente de datos
Grafana has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Issues addressed include cross site scripting and information leakage vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-12-02 CVE Reserved
- 2020-08-28 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20200918-0003 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-19499 | 2020-11-04 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1873615 | 2020-11-04 |