CVE-2021-28148

Katalog CVE

CVSS 7.5 · High EPSS 3,5%

Kerentanan Missing Authentication for Critical Function pada grafana. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.

Rincian

Terbit di NVD

22 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

3,5% peluang dieksploitasi; lebih tinggi dari 88,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724 advisory vendor
• https://community.grafana.com/t/release-notes-v6-7-x/27119 release notes · advisory vendor
• https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-... release notes · advisory vendor
• https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/ release notes · advisory vendor
• https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/ release notes · advisory vendor
• https://grafana.com/products/enterprise/ product · advisory vendor
• https://security.netapp.com/advisory/ntap-20210430-0005/ advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2021/03/19/5 mailing list · advisory pihak ketiga