CVE-2021-28148

Опубликовано: 22 мар. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.

Ссылки

https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
Vendor Advisory
https://community.grafana.com/t/release-notes-v6-7-x/27119
Release Notes
Vendor Advisory
https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
Release Notes
Vendor Advisory
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/
Release Notes
Vendor Advisory
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/
Release Notes
Vendor Advisory
https://grafana.com/products/enterprise/
Product
Vendor Advisory
https://security.netapp.com/advisory/ntap-20210430-0005/
Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/03/19/5
Mailing List
Third Party Advisory
https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
Vendor Advisory
https://community.grafana.com/t/release-notes-v6-7-x/27119
Release Notes
Vendor Advisory
https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
Release Notes
Vendor Advisory
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/
Release Notes
Vendor Advisory
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/
Release Notes
Vendor Advisory
https://grafana.com/products/enterprise/
Product
Vendor Advisory
https://security.netapp.com/advisory/ntap-20210430-0005/
Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/03/19/5
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*

Версия от 6.0.0 (включая) до 6.7.6 (исключая)

cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*

Версия от 7.0.0 (включая) до 7.3.10 (исключая)

cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*

Версия от 7.4.0 (включая) до 7.4.5 (исключая)

EPSS

Процентиль: 88%

0.04284

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-306

Связанные уязвимости

CVE-2021-28148

CVSS3: 7.5

ubuntu

около 4 лет назад

CVE-2021-28148

CVSS3: 7.5

redhat

больше 4 лет назад

CVE-2021-28148

CVSS3: 7.5

debian

около 4 лет назад

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x ...

GHSA-qhvm-m99m-qq44

CVSS3: 7.5

github

около 3 лет назад

openSUSE-SU-2021:2675-1

suse-cvrf

почти 4 года назад

Security update for SUSE Manager Client Tools

EPSS

Процентиль: 88%

0.04284

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-306