CVE-2019-19499

6.5 mediumEPSS 3.5%

Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 3.5% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2020-08-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

grafana:grafana

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-4pwp-cx67-5cpx	Go	github.com/grafana/grafana	<6.4.4	6.4.4
GO-2024-2661	Go	github.com/grafana/grafana	all versions	no fix published

References

https://security.netapp.com/advisory/ntap-20200918-0003/
https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read/
https://security.netapp.com/advisory/ntap-20200918-0003/
https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read/

Check your stack JSON