NVD Vulnerability Detail

CVE-2018-19039

Summary	Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.
Publication Date	Dec. 14, 2018, 4:29 a.m.
Registration Date	March 1, 2021, 7:11 p.m.
Last Update	Nov. 21, 2024, 12:57 p.m.

Affected software configurations

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:a:redhat:ceph_storage:3.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:netapp:active_iq_performance_analytics_services:-:::::::*
cpe:2.3:a:netapp:storagegrid_webscale_nas_bridge:-:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html
2	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html
3	http://www.securityfocus.com/bid/105994	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/105994	Third Party Advisory VDB Entry
5	https://access.redhat.com/errata/RHSA-2019:0747	Third Party Advisory
6	https://access.redhat.com/errata/RHSA-2019:0747	Third Party Advisory
7	https://access.redhat.com/errata/RHSA-2019:0911	Third Party Advisory
8	https://access.redhat.com/errata/RHSA-2019:0911	Third Party Advisory
9	https://community.grafana.com/t/grafana-5-3-3-and-4-6-5-security-update/11961	Patch Vendor Advisory
10	https://community.grafana.com/t/grafana-5-3-3-and-4-6-5-security-update/11961	Patch Vendor Advisory
11	https://security.netapp.com/advisory/ntap-20190416-0004/	Third Party Advisory
12	https://security.netapp.com/advisory/ntap-20190416-0004/	Third Party Advisory
13	https://www.percona.com/blog/2018/11/20/how-cve-2018-19039-affects-percona-monitoring-and-management/	Third Party Advisory
14	https://www.percona.com/blog/2018/11/20/how-cve-2018-19039-affects-percona-monitoring-and-management/	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

Grafana における情報漏えいに関する脆弱性

Title	Grafana における情報漏えいに関する脆弱性
Summary	Grafana には、情報漏えいに関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 18, 2018, midnight
Registration Date	Feb. 14, 2019, 5:37 p.m.
Last Update	Feb. 14, 2019, 5:37 p.m.

Affected System

Grafana Labs

Grafana 4.6.5 未満

Grafana 5.3.3 未満の 5.x

Grafana 4.6.5 未満

Grafana 5.3.3 未満の 5.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-19039	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19039
2	CVE-2018-19039	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19039
National Vulnerability Database (NVD)
3	CVE-2018-19039	https://nvd.nist.gov/vuln/detail/CVE-2018-19039
4	CVE-2018-19039	https://nvd.nist.gov/vuln/detail/CVE-2018-19039

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html
2	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Grafana Labs
1	Grafana 5.3.3 and 4.6.5 Security Update	https://community.grafana.com/t/grafana-5-3-3-and-4-6-5-security-update/11961
2	Grafana 5.3.3 and 4.6.5 Security Update	https://community.grafana.com/t/grafana-5-3-3-and-4-6-5-security-update/11961

Change Log

No	Changed Details	Date of change
1	[2019年02月14日] 掲載	Feb. 14, 2019, 5:37 p.m.