CVE-2021-28148

Name
CVE-2021-28148
Description
One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Release Notes https://community.grafana.com/t/release-notes-v6-7-x/27119
Product https://grafana.com/products/enterprise/
Mailing List https://www.openwall.com/lists/oss-security/2021/03/19/5
Vendor Advisory https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
Release Notes https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/
Release Notes https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
Release Notes https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/
CONFIRM https://security.netapp.com/advisory/ntap-20210430-0005/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* grafana >= 6.0.0 < 6.7.6
cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* grafana >= 7.0.0 < 7.3.10
cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* grafana >= 7.4.0 < 7.4.5

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
grafana 3.13-community 7.3.6-r0 Konstantin Kulikov <k.kulikov2@gmail.com> possibly vulnerable