Every CVE Search/ Get API key

CVE-2020-12459

Grafana world readable configuration files

5.5 MediumFix available

CVE-2020-12459 is a medium vulnerability (CVSS 5.5) in Grafana, published April 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in github.com/grafana/grafana 7.2.1.

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.32%Down 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Record
CVE-2020-12459
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-732
Updated
2026-11-02
CVE List No score

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Record
CVE-2020-12459
Updated
2026-11-02
EUVDEUVD-2022-4464 No score

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Record
EUVD-2022-4464
Updated
2026-11-03
GitHub AdvisoriesGHSA-m25m-5778-fm22 7.1

Grafana world readable configuration files

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Record
GHSA-m25m-5778-fm22
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-732
Updated
2026-11-02
OSV 5.5

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Record
CVE-2020-12459
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-m25m-5778-fm22 7.1

Grafana world readable configuration files

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Record
GHSA-m25m-5778-fm22
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-732
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2020:2362 9.1

Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update

Record
RHSA-2020:2362
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:4682 6.5

Red Hat Security Advisory: grafana security, bug fix, and enhancement update

Record
RHSA-2020:4682
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2020:4682 No score

Moderate: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (6.7.4). (BZ#1807323)

Security Fix(es):

  • grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen (CVE-2018-18624)

  • grafana: arbitrary file read via MySQL data source (CVE-2019-19499)

  • grafana: stored XSS (CVE-2020-11110)

  • grafana: XSS annotation popup vulnerability (CVE-2020-12052)

  • grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)

  • grafana: information disclosure through world-readable /var/lib/grafana/grafana.db (CVE-2020-12458)

  • grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

  • grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2020:4682
Updated
2026-11-02
OSVBIT-grafana-2020-12459 No score

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

Record
BIT-grafana-2020-12459
Updated
2026-11-02
OSVGO-2024-2519 No score

Grafana world readable configuration files in github.com/grafana/grafana

Grafana world readable configuration files in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana from v6.0.0 before v7.2.1.

Record
GO-2024-2519
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 6.0.0-beta1 up to 7.2.1
7.2.1
grafana
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-azure-monitor
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-cloudwatch
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-elasticsearch
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-graphite
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-influxdb
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-loki
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-mssql
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-mysql
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
Show 24 moreShow less
Affected packages
PackageAffectedFixed
grafana-opentsdb
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-postgres
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-prometheus
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-stackdriver
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana
Bitnami
 6.0.0 up to 6.3.7
6.3.7
github.com/grafana/grafana
Go
 All versions None known
jaeger
Red Hat:service_mesh:1.0::el7
 before 0:v1.13.1.redhat7-1.el7
0:v1.13.1.redhat7-1.el7
kiali
Red Hat:service_mesh:1.0::el7
 before 0:v1.0.11.redhat1-1.el7
0:v1.0.11.redhat1-1.el7
servicemesh-grafana
Red Hat:service_mesh:1.0::el8
 before 0:6.2.2-36.el8
0:6.2.2-36.el8
servicemesh-grafana-prometheus
Red Hat:service_mesh:1.0::el8
 before 0:6.2.2-36.el8
0:6.2.2-36.el8
grafana
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-azure-monitor
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-cloudwatch
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-elasticsearch
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-graphite
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-influxdb
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-loki
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-mssql
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-mysql
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-opentsdb
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-postgres
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-prometheus
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-stackdriver
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 67 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open