CVE-2020-12458

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 7.2.1 Grafana versions through 6.7.3

Description An information-disclosure flaw was found in Grafana. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information, such as cleartext or encrypted datasource passwords.

Recommendations For versions through 6.7.3, consider restricting access to the database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db to prevent exposure of sensitive information. For versions prior to 7.2.1, update to version 7.2.1 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the database directory and file to prevent world readability until a patch is applied.