CVE-2021-27962
First published: Mon Mar 22 2021(Updated: )
Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Grafana Grafana | >=7.2.0<7.3.10 | |
| Grafana Grafana | >=7.4.0<7.4.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2021/03/19/5
- https://community.grafana.com
- https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
- https://community.grafana.com/t/release-notes-v6-7-x/27119
- https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/
Frequently Asked Questions
What is the vulnerability ID of this Grafana Enterprise issue?
The vulnerability ID is CVE-2021-27962.
What is the severity of CVE-2021-27962?
The severity of CVE-2021-27962 is high.
Which versions of Grafana Enterprise are affected by CVE-2021-27962?
Grafana Enterprise versions 7.2.x and 7.3.x before 7.3.10 and versions 7.4.x before 7.4.5 are affected.
What can an attacker do if they exploit CVE-2021-27962?
An attacker who exploits CVE-2021-27962 can bypass a permission check on a data source they should not be able to access.
How can I fix CVE-2021-27962?
To fix CVE-2021-27962, upgrade your Grafana Enterprise installation to version 7.3.10 or 7.4.5 or later.
- collector/nvd-index
- agent/author
- agent/severity
- agent/references
- agent/tags
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/grafana
- canonical/grafana grafana
- version/grafana grafana/7.2.0
- version/grafana grafana/7.4.0