| Package | Affected versions | Patched versions |
|---|---|---|
| grafana | = 8.4.3 |
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free