6.5

CVE-2021-28147

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grafana ≫ Grafana SwEdition enterprise Version >= 6.0.0 < 6.7.6
Grafana ≫ Grafana SwEdition enterprise Version >= 7.0.0 < 7.3.10
Grafana ≫ Grafana SwEdition enterprise Version >= 7.4.0 < 7.4.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.61% 0.728
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NIST 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://community.grafana.com/t/release-notes-v6-7-x/27119
Vendor Advisory
Release Notes
https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
Vendor Advisory
https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
Vendor Advisory
Release Notes
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/
Vendor Advisory
Release Notes
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/
Vendor Advisory
Release Notes
https://grafana.com/products/enterprise/
Vendor Advisory
Product
https://www.openwall.com/lists/oss-security/2021/03/19/5
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20210430-0005/
Third Party Advisory