-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from improper file permissions on grafana.db. The GitHub patch shows critical changes in sqlstore.go where: 1) File creation now uses 0640 permissions, 2) Existing file permissions are validated. The getEngine() function is responsible for database initialization, and prior to the patch, it didn't enforce strict permissions. The CWE-732 (Incorrect Permission Assignment) directly maps to this missing permission enforcement in database file creation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/grafana/grafana | go | < 7.2.1 | 7.2.1 |
Ongoing coverage of React2Shell