An update on 0day CVE-2021-43798: Grafana directory traversal

Re:An update on 0day CVE-2021-43798: Grafana directory trave... by alphahsl on Wednesday December 08, 2021 @08:08PM (#29492640)

> Customers get a week to upgrade under strict embargo

Seems that they can enforce an embargo with their private customers so that it won't become a 0day.

It became a 0day because the security researcher inadvertently kicked off public discussion.

[ Parent | on HN ]

Re:An update on 0day CVE-2021-43798: Grafana directory trave... by alphahsl on Wednesday December 08, 2021 @10:41PM (#29493566)

I should clarify that “inadvertently” is the key word here. The 0day happened because of a number of factors detailed in the post, and it isn’t the fault of any one person.

[ Parent | on HN ]

Re:An update on 0day CVE-2021-43798: Grafana directory trave... by RichiH on Thursday December 09, 2021 @04:38AM (#29495482)

Agreed. We will certainly improve processes on our end as a direct result of this, as well.

[ Parent | on HN ]