PT-2021-17695 · Grafana+2 · Grafana Enterprise+3

Published 2021-03-22 · Updated 2024-06-15 · CVE-2021-27962

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Grafana Enterprise versions 7.2.x through 7.3.x before 7.3.10 Grafana Enterprise versions 7.4.x before 7.4.5

Description: The issue allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.

Recommendations: For Grafana Enterprise versions 7.2.x through 7.3.x before 7.3.10, update to version 7.3.10 or later. For Grafana Enterprise versions 7.4.x before 7.4.5, update to version 7.4.5 or later.

Fix

Related Identifiers

ALT-PU-2021-1708

BIT-GRAFANA-2021-27962

CVE-2021-27962

OPENSUSE-SU-2021:1148-1

OPENSUSE-SU-2021:1162-1

OPENSUSE-SU-2021:2662-1

OPENSUSE-SU-2021:2675-1

OPENSUSE-SU-2021_1148-1

OPENSUSE-SU-2021_1162-1

OPENSUSE-SU-2021_2662-1

OPENSUSE-SU-2021_2675-1

OPENSUSE-SU-2024:10818-1

SUSE-SU-2021:2660-1

SUSE-SU-2021:2673-1

SUSE-SU-2021:2675-1

SUSE-SU-2021:3907-1

SUSE-SU-2021:3908-1

Affected Products

Alt Linux

Grafana

Grafana Enterprise

Suse

References · 47

• https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-grafana-2021-27962 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:2662-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2660-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1148-1 · Vendor Advisory
• https://community.grafana.com · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10818-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1162-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2673-1 · Vendor Advisory
• https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2675-1 · Vendor Advisory
• https://community.grafana.com/t/release-notes-v6-7-x/27119 · Vendor Advisory
• https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27962 · Security Note