CVE-2021-28148: High severity grafana labs grafana oss and enterprise vulnerability
One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-28148?
CVE-2021-28148 is a vulnerability in Grafana Enterprise versions 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5, which allows unauthenticated users to send unlimited requests to a specific API endpoint, causing denial of service (DoS).
How severe is CVE-2021-28148?
CVE-2021-28148 has a severity rating of 7.5 (high).
How can the vulnerability be exploited?
Unauthenticated users can exploit CVE-2021-28148 by sending an unlimited number of requests to the vulnerable API endpoint, causing a denial of service.
Which versions of Grafana Enterprise are affected by CVE-2021-28148?
Grafana Enterprise versions 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 are affected by CVE-2021-28148.
How do I fix CVE-2021-28148?
To fix CVE-2021-28148, it is recommended to upgrade Grafana Enterprise to version 6.7.6, 7.3.10, or 7.4.5, or a later version that includes the security patch.