Skip to content
Fencer Vulns
medium 6.5

CVE-2018-19039 json

Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissio…

published 2018-12-13 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-10757

cvss
6.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
7.3%
EPSS 7.3% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.

Patch / fix

  • grafana grafana 4.6.5, 5.3.3
  • ceph ceph storage 2 2:10.2.10-49.el7cp
  • grafana ceph storage 2 4.3.2-4.el7cp
  • librbd1 ceph storage 2 2:10.2.10-49.el7cp
  • librgw2 ceph storage 2 2:10.2.10-49.el7cp
  • ceph-mds ceph storage 2 2:10.2.10-49.el7cp
  • ceph-mon ceph storage 2 2:10.2.10-49.el7cp
  • ceph-osd ceph storage 2 2:10.2.10-49.el7cp
  • ceph-base ceph storage 2 2:10.2.10-49.el7cp

red hat advisories RHSA-2019:0747RHSA-2019:0911

  • kibana OpenStack Cloud Crowbar 9, OpenStack Cloud 9 4.6.6-4.9.2
  • grafana OpenStack Cloud Crowbar 9, OpenStack Cloud 9 6.7.4-3.23.2
  • cassandra OpenStack Cloud Crowbar 9, OpenStack Cloud 9 3.11.10-3.3.3
  • python-py OpenStack Cloud Crowbar 9, OpenStack Cloud 9 1.5.4-3.3.2
  • ardana-swift OpenStack Cloud 9 9.0+git.1618235096.90974ed-3.10.2
  • ardana-neutron OpenStack Cloud 9 9.0+git.1615223676.777f0b3-3.25.2
  • openstack-nova OpenStack Cloud Crowbar 9, OpenStack Cloud 9 18.3.1~dev82-3.37.6
  • python-Django1 OpenStack Cloud Crowbar 9, OpenStack Cloud 9 1.11.29-3.25.1

suse advisories SUSE-SU-2021:1962-1SUSE-SU-2020:1273-1SUSE-SU-2019:2867-1SUSE-SU-2019:2671-1SUSE-SU-2019:2046-1SUSE-OU-2019:2023-1

  • grafana openSUSE Tumbleweed 7.5.7-1.2
  • grafana Package Hub 15 SP1 7.1.5-bp151.2.1

opensuse advisories openSUSE-SU-2024:10818-1openSUSE-SU-2020:1611-1

  • grafana Arch Linux 5.3.4-1

arch linux advisories AVG-811

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-19039 updated cvss 6.5

grafana: File exfiltration

  • Red Hat OpenShift Container Platform 3.11 openshift3/grafana
    affected: no fix available
  • Red Hat OpenStack Platform 8 (Liberty) Operational Tools grafana Red Hat OpenStack Platform 9 (Mitaka) Operational Tools grafana Red Hat Storage 3 grafana
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 2.5 MON ceph 10.2.10-49.el7cp, librbd1 10.2.10-49.el7cp, librgw2 10.2.10-49.el7cp, ceph-mon 10.2.10-49.el7cp, ceph-base 10.2.10-49.el7cp, ceph-test 10.2.10-49.el7cp, +7 more Red Hat Ceph Storage 2.5 OSD ceph 10.2.10-49.el7cp, librbd1 10.2.10-49.el7cp, librgw2 10.2.10-49.el7cp, ceph-osd 10.2.10-49.el7cp, ceph-base 10.2.10-49.el7cp, ceph-test 10.2.10-49.el7cp, +7 more Red Hat Ceph Storage 2.5 Tools ceph 10.2.10-49.el7cp, grafana 4.3.2-4.el7cp, librbd1 10.2.10-49.el7cp, librgw2 10.2.10-49.el7cp, ceph-mds 10.2.10-49.el7cp, ceph-base 10.2.10-49.el7cp, +10 more
    fixed: vendor fix RHSA-2019:0747
  • Red Hat Ceph Storage 3.2 MON ceph 12.2.8-128.el7cp, librbd1 12.2.8-128.el7cp, librgw2 12.2.8-128.el7cp, ceph-mgr 12.2.8-128.el7cp, ceph-mon 12.2.8-128.el7cp, ceph-base 12.2.8-128.el7cp, +10 more Red Hat Ceph Storage 3.2 OSD ceph 12.2.8-128.el7cp, librbd1 12.2.8-128.el7cp, librgw2 12.2.8-128.el7cp, ceph-osd 12.2.8-128.el7cp, ceph-base 12.2.8-128.el7cp, ceph-test 12.2.8-128.el7cp, +9 more Red Hat Ceph Storage 3.2 Tools ceph 12.2.8-128.el7cp, grafana 5.2.4-2.el7cp, librbd1 12.2.8-128.el7cp, librgw2 12.2.8-128.el7cp, ceph-mds 12.2.8-128.el7cp, ceph-base 12.2.8-128.el7cp, +13 more
    fixed: vendor fix RHSA-2019:0911
  • Red Hat OpenShift Container Platform 4 openshift4/ose-grafana
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

7.28% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.