PT-2021-17772 · Grafana+1 · Grafana Enterprise+2

Published 2021-03-22 · Updated 2024-06-15 · CVE-2021-28146

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Grafana Enterprise versions 7.4.0 through 7.4.4

Description: The team sync HTTP API in Grafana Enterprise has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this issue allows any authenticated user to add external groups to existing teams, potentially granting a user team permissions that the user isn't supposed to have.

Recommendations: For versions 7.4.0 through 7.4.4, update to version 7.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the team sync HTTP API to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-GRAFANA-2021-28146

CVE-2021-28146

OPENSUSE-SU-2021:1148-1

OPENSUSE-SU-2021:1162-1

OPENSUSE-SU-2021:2662-1

OPENSUSE-SU-2021:2675-1

OPENSUSE-SU-2021_1148-1

OPENSUSE-SU-2021_1162-1

OPENSUSE-SU-2021_2662-1

OPENSUSE-SU-2021_2675-1

OPENSUSE-SU-2024:10818-1

SUSE-SU-2021:2660-1

SUSE-SU-2021:2673-1

SUSE-SU-2021:2675-1

SUSE-SU-2021:3907-1

SUSE-SU-2021:3908-1

Affected Products

Grafana

Grafana Enterprise

Suse

References · 47

• https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28146 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2660-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1148-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10818-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1162-1 · Vendor Advisory
• https://grafana.com/products/enterprise · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2673-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-28146 · Vendor Advisory
• https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise · Vendor Advisory
• https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2675-1 · Vendor Advisory
• https://community.grafana.com/t/release-notes-v6-7-x/27119 · Vendor Advisory
• https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-grafana-2021-28146 · Vendor Advisory