CVE-2022-32275

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd U...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami grafana

[{"type":"SEMVER","events":[{"introduced":"8.4.3"},{"fixed":"8.4.4"}]}]

参照URL

advisory security.netapp.com
advisory nvd.nist.gov
advisory github.com
package github.com
report github.com
report github.com
web github.com
web grafana.com