Patchfirst
Patchfirst
CVE-2020-13379 Public exploit EPSS 99.9%

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue

Summary

The avatar feature in Grafana versions 3.0.1 through 7.0.1 contains a server-side request forgery flaw caused by incorrect access control. An unauthenticated attacker can make Grafana send HTTP requests to arbitrary URLs and return the responses to them, which can reveal information about the network Grafana runs on, and passing invalid URL objects can crash Grafana with a segmentation fault.

Official description · CVE.org

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.

Breakdown
60.7 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 4 years after disclosure. Public exploit code (Exploit-DB) appeared 33 days after disclosure.

  1. Disclosedday 0
  2. Public exploit codeExploit-DB+33 days
  3. First seen exploitedVulnCheck KEV evidence+4 yrs

7 fixes in github.com/grafana/grafana over 6 months. The latest fix listed for github.com/grafana/grafana is 7.2.1.

Fixes in github.com/grafana/grafanaGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 6.7.3CVE-2020-1224524 Apr 2020
  2. 7.0.0CVE-2020-1343024 May 2020
  3. 7.0.0CVE-2018-186242 Jun 2020
  4. 7.0.2CVE-2020-133793 Jun 2020
  5. 7.1.0-beta1CVE-2020-2430328 Oct 2020
  6. 7.2.1CVE-2020-1245829 Apr 2020
  7. 7.2.1CVE-2020-1245929 Apr 2020Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: github.com/grafana/grafana.

Gogithub.com/grafana/grafanaGHSA-wc9w-wvq2-ffm9

Upgrade to 7.5.11

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2021-27358, CVE-2021-39226).

Still affected on this line by CVE-2022-31097 (no fix published); CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).

Gogo get github.com/grafana/grafana@v7.5.11

First fixed in 7.0.2 for CVE-2020-13379.

Affected versions, by release line

If you runUpgrade to
7.0.0 up to 7.0.27.5.11first fix for this CVE: 7.0.2
3.0.1 up to 6.7.4

Still affected on this line by CVE-2021-27358 (fixed in 7.4.2, a newer line); CVE-2021-39226 (fixed in 7.5.11, a newer line); CVE-2022-31097 (no fix published); CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).

6.7.4

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 1 community threat pulse (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

28 links, grouped by NVD tag

x_refsource_MISC 6

community.grafana.com/t/release-notes-v6-7-x/27119community.grafana.com/t/grafana-7-0-2-and-6-7-4-security-update/31408community.grafana.com/t/release-notes-v7-0-x/29381mostwanted002.cf/post/grafanados/packetstormsecurity.com/files/158320/Grafana-7.0.1-Denial-Of-Service.htmlrhynorater.github.io/CVE-2020-13379-Write-Up

x_refsource_CONFIRM 3

openwall.com/lists/oss-security/2020/06/03/4grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/security.netapp.com/advisory/ntap-20200608-0006/

mailing-list 13

openwall.com/lists/oss-security/2020/06/09/2lists.apache.org/thread.html/re75f59639f3bc1d14c7ab362bc4485ade84f3c6a3c1a03200c20fe13%40%3Cissues.ambari.apache.org%3Elists.apache.org/thread.html/r6bb57124a21bb638f552d81650c66684e70fc1ff9f40b6a8840171cd%40%3Cissues.ambari.apache.org%3Elists.apache.org/thread.html/r40f0a97b6765de6b8938bc212ee9dfb5101e9efa48bcbbdec02b2a60%40%3Cissues.ambari.apache.org%3Elists.apache.org/thread.html/r093b405a49fd31efa0d949ac1a887101af1ca95652a66094194ed933%40%3Cdev.ambari.apache.org%3Elists.apache.org/thread.html/rba0247a27be78bd14046724098462d058a9969400a82344b3007cf90%40%3Cdev.ambari.apache.org%3Elists.apache.org/thread.html/rff71126fa7d9f572baafb9be44078ad409c85d2c0f3e26664f1ef5a2%40%3Cdev.ambari.apache.org%3Elists.apache.org/thread.html/re7c4b251b52f49ba6ef752b829bca9565faaf93d03206b1db6644d31%40%3Cdev.ambari.apache.org%3E
Show 5 moreShow fewerlists.apache.org/thread.html/rad99b06d7360a5cf6e394afb313f8901dcd4cb777aee9c9197b3b23d%40%3Cdev.ambari.apache.org%3Elists.apache.org/thread.html/r0928ee574281f8b6156e0a6d0291bfc27100a9dd3f9b0177ece24ae4%40%3Cdev.ambari.apache.org%3Elists.apache.org/thread.html/rd0fd283e3844b9c54cd5ecc92d966f96d3f4318815bbf3ac41f9c820%40%3Ccommits.ambari.apache.org%3Elists.apache.org/thread.html/r6670a6c29044bcb77d4e5d165b5bd13fffe37b84caa5d6471b13b3a2%40%3Cdev.ambari.apache.org%3Elists.apache.org/thread.html/r984c3b42a500f5a6a89fbee436b9432fada5dc27ebab04910aafe4da%40%3Cissues.ambari.apache.org%3E

vendor-advisory 6

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O2KSCCGKNEENZN3DW7TSPFBBUZH3YZXZ/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEKSZ6GE4EDOFZ23NGYWOCMD6O4JF5SO/lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.htmllists.opensuse.org/opensuse-security-announce/2020-07/msg00083.htmllists.opensuse.org/opensuse-security-announce/2020-10/msg00009.htmllists.opensuse.org/opensuse-security-announce/2020-10/msg00017.html
↑ ↓ chooseEnter openEsc close