7.5

CVE-2021-28148

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grafana ≫ Grafana SwEditionenterprise Version >= 6.0.0 < 6.7.6
Grafana ≫ Grafana SwEditionenterprise Version >= 7.0.0 < 7.3.10
Grafana ≫ Grafana SwEditionenterprise Version >= 7.4.0 < 7.4.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.5% 0.876
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://community.grafana.com/t/release-notes-v6-7-x/27119
Vendor Advisory
Release Notes
https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
Vendor Advisory
https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
Vendor Advisory
Release Notes
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/
Vendor Advisory
Release Notes
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/
Vendor Advisory
Release Notes
https://grafana.com/products/enterprise/
Vendor Advisory
Product
https://www.openwall.com/lists/oss-security/2021/03/19/5
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20210430-0005/
Third Party Advisory