CVE-2020-13379

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Jun 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-13387.8<p>A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker w CVE-2020-133809.8openSIS before 7.4 allows SQL Injection.CVE-2020-133819.8openSIS through 7.4 allows SQL Injection.CVE-2020-133829.1openSIS through 7.4 has Incorrect Access Control.CVE-2020-133837.5openSIS through 7.4 allows Directory Traversal.CVE-2020-133848.8Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, fo CVE-2020-133867.3In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated Users group on the SmartDraw 2020 installat CVE-2020-133877.5Pexip Infinity before 23.4 has a lack of input validation, leading to temporary denial of service via H.323.CVE-2020-133889.8An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a CVE-2020-133899.8An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V1 CVE-2020-13397.8A remote code execution vulnerability exists when Windows Media Audio Codec improperly handles objects. An attacker who successfully exploit CVE-2020-133909.8An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V1