Vulnerability record · CVE-2020-13379 · published 3 June 2020
CVE-2020-13379: Grafana avatar feature unauthenticated SSRF and denial of service
Grafana · Grafana
The avatar feature in Grafana 3.0.1 through 7.0.1 allows any unauthenticated client to make the server issue HTTP requests to arbitrary URLs and return the response, an SSRF incorrect access control flaw. It also lets an attacker pass invalid URL objects that can crash Grafana via segfault, so it exposes internal network information and offers a denial-of-service path.
Description
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Automated analysis
high priorityUnauthenticated network-reachable SSRF with a high CVSS score, very high EPSS, and a public DoS exploit, though it is not in KEV and impact is limited to information disclosure and availability.
What it is
The avatar feature in Grafana 3.0.1 through 7.0.1 allows any unauthenticated client to make the server issue HTTP requests to arbitrary URLs and return the response, an SSRF incorrect access control flaw. It also lets an attacker pass invalid URL objects that can crash Grafana via segfault, so it exposes internal network information and offers a denial-of-service path.
Impact
An attacker gains a server-side request proxy to probe internal networks and services reachable from the Grafana host, and can crash the Grafana process by supplying malformed URL objects.
Attack surface
Reachable over the network through the avatar endpoint with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any client that can reach the Grafana HTTP interface can trigger it.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.99856 probability, 0.99961 percentile) and a public exploit reference exists for the Grafana 7.0.1 denial of service. No ransomware group use is documented.
What to do
- Upgrade Grafana to 6.7.4 or 7.0.2, the vendor releases containing the security fix, or later.
- Apply the corresponding distribution updates for Fedora, openSUSE Leap and backports SLE packages.
- Restrict network access to the Grafana HTTP interface to trusted users and networks until patching is complete.
- Block or monitor outbound requests from Grafana hosts to internal address ranges and metadata endpoints.
- If the avatar feature is not needed, disable it or restrict avatar URL handling.
Detection
- Monitor Grafana server logs for avatar requests containing unusual or internal URLs.
- Alert on outbound HTTP connections originating from Grafana hosts to internal RFC1918 addresses or cloud metadata endpoints.
- Watch for Grafana process crashes or segfaults correlated with avatar endpoint requests.
- Review web access logs for repeated or malformed requests to the avatar endpoint from unauthenticated clients.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-13379 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-13379), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
