CVE-2021-28148
First published: Mon Mar 22 2021(Updated: )
One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Grafana Grafana | >=6.0.0<6.7.6 | |
| Grafana Grafana | >=7.0.0<7.3.10 | |
| Grafana Grafana | >=7.4.0<7.4.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
- https://community.grafana.com/t/release-notes-v6-7-x/27119
- https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/
- https://grafana.com/products/enterprise/
- https://security.netapp.com/advisory/ntap-20210430-0005/
- https://www.openwall.com/lists/oss-security/2021/03/19/5
Frequently Asked Questions
What is CVE-2021-28148?
CVE-2021-28148 is a vulnerability in Grafana Enterprise versions 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5, which allows unauthenticated users to send unlimited requests to a specific API endpoint, causing denial of service (DoS).
How severe is CVE-2021-28148?
CVE-2021-28148 has a severity rating of 7.5 (high).
How can the vulnerability be exploited?
Unauthenticated users can exploit CVE-2021-28148 by sending an unlimited number of requests to the vulnerable API endpoint, causing a denial of service.
Which versions of Grafana Enterprise are affected by CVE-2021-28148?
Grafana Enterprise versions 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 are affected by CVE-2021-28148.
How do I fix CVE-2021-28148?
To fix CVE-2021-28148, it is recommended to upgrade Grafana Enterprise to version 6.7.6, 7.3.10, or 7.4.5, or a later version that includes the security patch.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/grafana
- canonical/grafana grafana
- version/grafana grafana/6.0.0
- version/grafana grafana/7.0.0
- version/grafana grafana/7.4.0