Intrusion PreventionGrafana.Labs.Grafana.Direct.Link.Image.Information.Disclosure
Description
This indicates an attack attempt against an Information Disclosure vulnerability in Grafana.
A remote, authenticated attacker can exploit this vulnerability by creating a crafted dashboard panel then requesting a static render of the panel. Successful exploitation results in the disclosure of arbitrary file contents from the target server.
Affected Products
Grafana Labs Grafana 4.x prior to 4.6.5
Grafana Labs Grafana 5.x prior to 5.3.3
Impact
Information Disclosure: Remote attackers can gain sensitive information from vulnerable systems.
Recommended Actions
Refer to the vendor supplied advisory for updates:
https://community.grafana.com/t/grafana-5-3-3-and-4-6-5-security-update/11961
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
Version Updates
| Date | Version | Detail |
|---|---|---|
| 2019-03-12 | 14.571 | Default_action:pass:drop |
| 2019-02-19 | 14.556 | Name:Grafana. Labs. Grafana. Direct. Link. Rendered. Image. Arbitrary. File:Grafana. Labs. Grafana. Direct. Link. Image. Information. Disclosure |
| 2019-02-15 | 14.554 |
| ID | 47442 |
| Created | Feb 19, 2019 |
| Updated | Mar 11, 2019 |
| Risk |
|
| CVE ID | CVE-2018-19039 |
| Exploit Prediction Score | 3.53% |
| Default Action | drop |
| Active | |
| Affected OS | All |
| Affected App | Other |