{"id":"CVE-2020-12459","published":"2020-04-29T15:56:56Z","modified":"2024-08-04T11:56:52Z","title":"In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and…","vendor":null,"product":null,"tier":"tail","description":{"text":"In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0032,"percentile":0.2505,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/grafana/grafana/issues/8283","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12459","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829724","tags":["x_refsource_CONFIRM"]},{"url":"https://src.fedoraproject.org/rpms/grafana/c/fab93d67363eb0a9678d9faf160cc88237f26277","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTQCKJZZYXMCSHJFZZ3YXEO5NUBANGZS/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WEBCIEVSYIDDCA7FTRS2IFUOYLIQU34A/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://security.netapp.com/advisory/ntap-20200518-0004/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":5.0,"factors":[{"name":"EPSS percentile","points":5.01}]},"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=6.0.0-beta1, <7.2.1","all versions"],"patched":["7.2.1"],"from":["GHSA-m25m-5778-fm22","GO-2024-2519"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4464","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-grafana-enterprise-cve-2018-15727","parents":[{"from":"CVE-2018-15727","to":"CVE-2020-12459","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["pkg/services/sqlstore/migrator/migrator.go"],"commits":["https://github.com/grafana/grafana/commit/7baecf0d0deae0d865e45cf03e082bc0db3f28c3","https://github.com/grafana/grafana/commit/df83bf10a225811927644bdf6265fa80bdea9137","https://github.com/grafana/grafana/commit/102448040d5132460e3b0013e03ebedec0677e00"],"basis":"shared function","functions":["Start"]}]}],"packageHistory":[{"cve":"CVE-2020-13379","published":"2020-06-03","fixed":"7.0.2","kev":false},{"cve":"CVE-2020-24303","published":"2020-10-28","fixed":"7.1.0-beta1","kev":false},{"cve":"CVE-2020-12458","published":"2020-04-29","fixed":"7.2.1","kev":false},{"cve":"CVE-2020-12459","published":"2020-04-29","fixed":"7.2.1","kev":false},{"cve":"CVE-2021-27358","published":"2021-03-18","fixed":"7.4.2","kev":false,"link":{"from":"CVE-2020-12459","to":"CVE-2021-27358","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"7.2.1","toFixed":"7.4.2","daysApart":323}]}},{"cve":"CVE-2021-39226","published":"2021-10-05","fixed":"8.1.6","kev":true},{"cve":"CVE-2021-41244","published":"2021-11-15","fixed":"8.2.4","kev":false}],"package":"Go:github.com/grafana/grafana"}}