One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-28148US | high7.5OT elevated | — | ||
One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows… | ||||
02
references
External citations — patches, advisories, analysis.
- https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724ADVISORY
- https://community.grafana.com/t/release-notes-v6-7-x/27119ADVISORY
- https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/ADVISORY
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/ADVISORY
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/ADVISORY
- https://grafana.com/products/enterprise/ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2021-28148WEB
- https://security.netapp.com/advisory/ntap-20210430-0005/ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan