---
id: 5132
title: "[CVE-2019-19499] Grafana 6.4.3 Arbitrary File Read"
cve: CVE-2019-19499
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read/"
published_at: "2020-08-27T15:07:04Z"
tags: ["vulnerability-research", "cve", "mysql", "grafana", "file-read"]
phying_url: "https://phying.com/item/5132"
lang: en
---

# [CVE-2019-19499] Grafana 6.4.3 Arbitrary File Read

## Summary

CVE-2019-19499 in Grafana 6.4.3: a rogue MySQL data source answers LOCAL INFILE requests to exfiltrate arbitrary files from the Grafana host, turning the 'add a data source' feature into an authenticated arbitrary file read.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **CVE:** CVE-2019-19499
- **Published:** 2020-08-27T15:07:04Z
- **Original:** https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read/
- **Phying News:** https://phying.com/item/5132