$ cve CVE-2020-13379 JSON

CVE-2020-13379 EXPLOIT

8.2

HIGH · CVSS 3.1 · EPSS 99.9% (pctl 100)

Patch early

A public exploit exists.

Description

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.

Scoring

CVSS	8.2 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
EPSS	99.86% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-918
On CISA KEV	no
Public exploit	yes
Published	2020-06-03
Last modified	2026-06-17

Affected (5)

Vendor	Product
fedoraproject	fedora
grafana	grafana
netapp	e-series performance analyzer
opensuse	backports sle
opensuse	leap

Public exploits

Source	Title	Date
exploit-db	Grafana 7.0.1 - Denial of Service (PoC)	2020-07-06

References

→ the Explorer · watch your stack · NVD