Every CVE Search/ Get API key

CVE-2020-12458

Grafana information disclosure

5.5 MediumFix available

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.49%Down 1.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

Record
CVE-2020-12458
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-732
Updated
2026-11-02
CVE List No score

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

Record
CVE-2020-12458
Updated
2026-11-02
EUVDEUVD-2022-2203 No score

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

Record
EUVD-2022-2203
Updated
2026-11-03
GitHub AdvisoriesGHSA-3jq7-8ph8-63xm 7.1

Grafana information disclosure

An information-disclosure flaw was found in Grafana. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

Record
GHSA-3jq7-8ph8-63xm
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-312, CWE-732
Updated
2026-11-02
OSV 5.5

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

Record
CVE-2020-12458
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-3jq7-8ph8-63xm 7.1

Grafana information disclosure

An information-disclosure flaw was found in Grafana. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

Record
GHSA-3jq7-8ph8-63xm
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-312, CWE-732
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2020:4682 6.5

Red Hat Security Advisory: grafana security, bug fix, and enhancement update

Record
RHSA-2020:4682
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-12458 5.5

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

Record
UBUNTU-CVE-2020-12458
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2020:4682 No score

Moderate: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (6.7.4). (BZ#1807323)

Security Fix(es):

  • grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen (CVE-2018-18624)

  • grafana: arbitrary file read via MySQL data source (CVE-2019-19499)

  • grafana: stored XSS (CVE-2020-11110)

  • grafana: XSS annotation popup vulnerability (CVE-2020-12052)

  • grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)

  • grafana: information disclosure through world-readable /var/lib/grafana/grafana.db (CVE-2020-12458)

  • grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

  • grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2020:4682
Updated
2026-11-02
OSVBIT-grafana-2020-12458 No score

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

Record
BIT-grafana-2020-12458
Updated
2026-11-02
OSVGO-2024-2513 No score

Grafana information disclosure in github.com/grafana/grafana

Grafana information disclosure in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v7.2.1.

Record
GO-2024-2513
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 before 7.2.1
7.2.1
grafana
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-azure-monitor
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-cloudwatch
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-elasticsearch
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-graphite
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-influxdb
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-loki
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-mssql
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-mysql
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
Show 21 moreShow less
Affected packages
PackageAffectedFixed
grafana-opentsdb
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-postgres
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-prometheus
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-stackdriver
AlmaLinux:8
From an advisory covering 8 CVEs
 before 6.7.4-3.el8
6.7.4-3.el8
grafana
Bitnami
 before 6.7.4
6.7.4
github.com/grafana/grafana
Go
 All versions None known
grafana
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-azure-monitor
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-cloudwatch
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-elasticsearch
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-graphite
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-influxdb
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-loki
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-mssql
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-mysql
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-opentsdb
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-postgres
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-prometheus
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-stackdriver
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.6.0+dfsg-1
 None known

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12458 is a medium vulnerability (CVSS 5.5) in Grafana, published April 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in github.com/grafana/grafana 7.2.1.

References

Show 51 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open