CrowdSecLive Exploit Tracker
Background NoiseCVE-2021-43798Public Exploit

Grafana - Path Traversal (CVE-2021-43798)

PublishedDec 7, 2021
First SeenDec 9, 2021
Last Seen
Reported
CVSS7.5
Grafana
GrafanaGrafana
web_application

Description

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: <grafana_host_url>/public/plugins//, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

psychologyCrowdSec Analysis

CVE-2021-43798 is a directory traversal vulnerability in Grafana that enables attackers to gain unauthorized access to local files by exploiting crafted plugin URL paths.

CrowdSec has been tracking this vulnerability and its exploits since 9th of December 2021.

CrowdSec network data shows that most actors exploiting CVE-2021-43798 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec network telemetry also shows that exploitation of CVE-2021-43798 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers typically probe for URL patterns containing /public/plugins/ to exploit this weakness.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2021-12-07
Rule Released2021-12-09
CrowdSec First Seen2021-12-09
CISA KEV2025-10-09
CISA Remediation Deadline2025-10-30

Related Weaknesses

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References