CVE-2021-39226

Katalog CVE

CVSS 7.3 · High KEV · sudah dieksploitasi EPSS 99,9%

Kerentanan Improper Authentication pada grafana, fedoraproject fedora. Skor CVSS 3.1 7.3 (High) menurut NVD. Masuk katalog KEV CISA pada 25 Agustus 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

Rincian

Terbit di NVD

5 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-862: Missing Authorization

EPSS (30 hari)

99,9% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Grafana Authentication Bypass Vulnerability

Masuk KEV

25 Agustus 2022

Tenggat CISA

15 September 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9 exploit · mitigasi · advisory vendor
• https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39226 pemerintah AS
• http://www.openwall.com/lists/oss-security/2021/10/05/4 mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211029-0008/ advisory pihak ketiga
• https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/ release notes
• https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/ release notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU... broken link
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6T... broken link