x/vulndb: potential Go vuln in github.com/grafana/grafana/pkg/api/avatar: GHSA-wc9w-wvq2-ffm9

[julieqiu]

In GitHub Security Advisory GHSA-wc9w-wvq2-ffm9, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/grafana/grafana/pkg/api/avatar	7.0.2	>= 7.0.0, < 7.0.2

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/grafana/grafana/pkg/api/avatar
    versions:
      - introduced: 7.0.0
        fixed: 7.0.2
  - package: github.com/grafana/grafana/pkg/api/avatar
    versions:
      - introduced: 3.0.1
        fixed: 6.7.4
description: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect
    Access Control issue that allows remote code execution. This vulnerability allows
    any unauthenticated user/client to make Grafana send HTTP requests to any URL
    and return its result to the user/client. This can be used to gain information
    about the network that Grafana is running on.
published: 2022-02-15T01:57:18Z
last_modified: 2022-04-12T22:53:25Z
cves:
  - CVE-2020-13379
ghsas:
  - GHSA-wc9w-wvq2-ffm9
links:
    context:
      - https://github.com/advisories/GHSA-wc9w-wvq2-ffm9