{"id":"CVE-2020-13379","published":"2020-06-03T18:41:09Z","modified":"2024-08-04T12:18:17Z","title":"The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.","provenance":"source","from":"CVE.org"},"summary":{"text":"The avatar feature in Grafana versions 3.0.1 through 7.0.1 contains a server-side request forgery flaw caused by incorrect access control. An unauthenticated attacker can make Grafana send HTTP requests to arbitrary URLs and return the responses to them, which can reveal information about the network Grafana runs on, and passing invalid URL objects can crash Grafana with a segmentation fault.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:07Z"},"cvss":null,"epss":{"score":0.99856,"percentile":0.99961,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-03-07","exploitedFirstSeen":"2024-03-07","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-07&host_type=src&vulnerability=cve-2020-13379","date":"2024-03-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-08&host_type=src&vulnerability=cve-2020-13379","date":"2024-03-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-09&host_type=src&vulnerability=cve-2020-13379","date":"2024-03-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-10&host_type=src&vulnerability=cve-2020-13379","date":"2024-03-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-11&host_type=src&vulnerability=cve-2020-13379","date":"2024-03-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-12&host_type=src&vulnerability=cve-2020-13379","date":"2024-03-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-13&host_type=src&vulnerability=cve-2020-13379","date":"2024-03-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-15&host_type=src&vulnerability=cve-2020-13379","date":"2024-03-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-22&host_type=src&vulnerability=cve-2020-13379","date":"2024-03-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-27&host_type=src&vulnerability=cve-2020-13379","date":"2024-03-27"}],"evidenceTotal":312,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes","url":"https://otx.alienvault.com/pulse/61695dd13611f59694746cda","created":"2021-10-15"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://community.grafana.com/t/release-notes-v6-7-x/27119","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2020/06/03/4","tags":["x_refsource_CONFIRM"]},{"url":"https://community.grafana.com/t/grafana-7-0-2-and-6-7-4-security-update/31408","tags":["x_refsource_MISC"]},{"url":"https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/","tags":["x_refsource_CONFIRM"]},{"url":"https://community.grafana.com/t/release-notes-v7-0-x/29381","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20200608-0006/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2020/06/09/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O2KSCCGKNEENZN3DW7TSPFBBUZH3YZXZ/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEKSZ6GE4EDOFZ23NGYWOCMD6O4JF5SO/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://mostwanted002.cf/post/grafanados/","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/158320/Grafana-7.0.1-Denial-Of-Service.html","tags":["x_refsource_MISC"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://rhynorater.github.io/CVE-2020-13379-Write-Up","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/re75f59639f3bc1d14c7ab362bc4485ade84f3c6a3c1a03200c20fe13%40%3Cissues.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r6bb57124a21bb638f552d81650c66684e70fc1ff9f40b6a8840171cd%40%3Cissues.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00017.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.apache.org/thread.html/r40f0a97b6765de6b8938bc212ee9dfb5101e9efa48bcbbdec02b2a60%40%3Cissues.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r093b405a49fd31efa0d949ac1a887101af1ca95652a66094194ed933%40%3Cdev.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rba0247a27be78bd14046724098462d058a9969400a82344b3007cf90%40%3Cdev.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rff71126fa7d9f572baafb9be44078ad409c85d2c0f3e26664f1ef5a2%40%3Cdev.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/re7c4b251b52f49ba6ef752b829bca9565faaf93d03206b1db6644d31%40%3Cdev.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rad99b06d7360a5cf6e394afb313f8901dcd4cb777aee9c9197b3b23d%40%3Cdev.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r0928ee574281f8b6156e0a6d0291bfc27100a9dd3f9b0177ece24ae4%40%3Cdev.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rd0fd283e3844b9c54cd5ecc92d966f96d3f4318815bbf3ac41f9c820%40%3Ccommits.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r6670a6c29044bcb77d4e5d165b5bd13fffe37b84caa5d6471b13b3a2%40%3Cdev.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r984c3b42a500f5a6a89fbee436b9432fada5dc27ebab04910aafe4da%40%3Cissues.ambari.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=3.0.1, <6.7.4",">=7.0.0, <7.0.2"],"patched":["6.7.4","7.0.2"],"from":["GHSA-wc9w-wvq2-ffm9"],"provenance":"source"}],"advisories":[{"id":"GHSA-wc9w-wvq2-ffm9","url":"https://github.com/advisories/GHSA-wc9w-wvq2-ffm9","severity":"MODERATE","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=3.0.1, <6.7.4"],"patched":["6.7.4"],"provenance":"source","from":"GHSA"},{"id":"GHSA-wc9w-wvq2-ffm9","url":"https://github.com/advisories/GHSA-wc9w-wvq2-ffm9","severity":"MODERATE","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=7.0.0, <7.0.2"],"patched":["7.0.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-1224","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1224","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":48638,"url":"https://www.exploit-db.com/exploits/48638","title":"Grafana 7.0.1 - Denial of Service (PoC)","type":"dos","platform":"linux","date":"2020-07-06","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-07-06"},"nuclei":[{"id":"CVE-2020-13379","name":"Grafana 3.0.1-7.0.1 - Server-Side Request Forgery","severity":"high","path":"http/cves/2020/CVE-2020-13379.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13379.yaml"}],"first":{"date":"2020-07-06","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/48638"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/158320/Grafana-7.0.1-Denial-Of-Service.html","https://www.exploit-db.com/exploits/48638"],"flow":[],"timeline":[{"date":"2020-06-03","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-13379","provenance":"source"},{"date":"2020-07-06","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-48638)","url":"https://www.exploit-db.com/exploits/48638","provenance":"source"},{"date":"2024-03-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-07&host_type=src&vulnerability=cve-2020-13379","provenance":"source"}],"speed":{"daysToPublicExploit":33,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":60.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 966 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 1 advisory exploit reference; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2020-12245","published":"2020-04-24","fixed":"6.7.3","kev":false,"link":{"from":"CVE-2020-12245","to":"CVE-2020-13379","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"6.7.3","toFixed":"6.7.4","daysApart":40}]}},{"cve":"CVE-2018-18624","published":"2020-06-02","fixed":"7.0.0","kev":false,"link":{"from":"CVE-2018-18624","to":"CVE-2020-13379","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"7.0.0","toFixed":"7.0.2","daysApart":1}]}},{"cve":"CVE-2020-13430","published":"2020-05-24","fixed":"7.0.0","kev":false},{"cve":"CVE-2020-13379","published":"2020-06-03","fixed":"7.0.2","kev":false},{"cve":"CVE-2020-24303","published":"2020-10-28","fixed":"7.1.0-beta1","kev":false,"link":{"from":"CVE-2020-13379","to":"CVE-2020-24303","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"7.0.2","toFixed":"7.1.0-beta1","daysApart":147}]}},{"cve":"CVE-2020-12458","published":"2020-04-29","fixed":"7.2.1","kev":false},{"cve":"CVE-2020-12459","published":"2020-04-29","fixed":"7.2.1","kev":false}],"package":"Go:github.com/grafana/grafana"}}