PT-2021-17773 · Grafana+2 · Grafana Enterprise+3

Vardan Torosyan · Published 2021-03-22 · Updated 2024-03-06 · CVE-2021-28147

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Grafana Enterprise versions 6.x through 6.7.5 Grafana Enterprise versions 7.x through 7.3.9 Grafana Enterprise versions 7.4.x through 7.4.4

Description: The team sync HTTP API in Grafana Enterprise presents an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this issue allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.

Recommendations: For Grafana Enterprise versions 6.x through 6.7.5, update to version 6.7.6 or later. For Grafana Enterprise versions 7.x through 7.3.9, update to version 7.3.10 or later. For Grafana Enterprise versions 7.4.x through 7.4.4, update to version 7.4.5 or later.

Exploit

Fix

Related Identifiers

ALT-PU-2021-1708

ALT-PU-2022-1177

ALT-PU-2022-1249

BIT-GRAFANA-2021-28147

CVE-2021-28147

OESA-2021-1445

OPENSUSE-SU-2021:1148-1

OPENSUSE-SU-2021:1162-1

OPENSUSE-SU-2021:2662-1

OPENSUSE-SU-2021:2675-1

OPENSUSE-SU-2021_1148-1

OPENSUSE-SU-2021_1162-1

OPENSUSE-SU-2021_2662-1

OPENSUSE-SU-2021_2675-1

SUSE-SU-2021:2660-1

SUSE-SU-2021:2673-1

SUSE-SU-2021:2675-1

SUSE-SU-2021:3907-1

SUSE-SU-2021:3908-1

Affected Products

Alt Linux

Grafana

Grafana Enterprise

Suse

References · 70

• 🔥 https://github.com/jas502n/Grafana-CVE-2021-43798 · Exploit
• 🔥 https://github.com/pedrohavay/exploit-grafana-CVE-2021-43798 · Exploit
• 🔥 https://github.com/taythebot/CVE-2021-43798 · Exploit
• 🔥 https://github.com/zer0yu/CVE-2021-43798 · Exploit
• 🔥 https://github.com/Mr-xn/CVE-2021-43798 · Exploit
• 🔥 https://github.com/ScorpionsMAX/CVE-2021-43798-Grafana-POC · Exploit
• 🔥 https://github.com/j-jasson/CVE-2021-43798-grafana_fileread · Exploit
• 🔥 https://github.com/M0ge/CVE-2021-43798-grafana_fileread · Exploit
• 🔥 https://github.com/asaotomo/CVE-2021-43798-Grafana-Exp · Exploit
• 🔥 https://github.com/culprits/Grafana_POC-CVE-2021-43798 · Exploit
• 🔥 https://github.com/Mo0ns/Grafana_POC-CVE-2021-43798 · Exploit
• 🔥 https://github.com/z3n70/CVE-2021-43798 · Exploit
• 🔥 https://github.com/K3ysTr0K3R/CVE-2021-43798-EXPLOIT · Exploit
• 🔥 https://github.com/rodpwn/CVE-2021-43798-mass_scanner · Exploit
• 🔥 https://github.com/s1gh/CVE-2021-43798 · Exploit