CVE-2022-32275

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd U...

Original description

The description as published by the source.

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami grafana

[{"type":"SEMVER","events":[{"introduced":"8.4.3"},{"fixed":"8.4.4"}]}]

References

advisory security.netapp.com
advisory nvd.nist.gov
advisory github.com
package github.com
report github.com
report github.com
web github.com
web grafana.com