PT-2021-17774 · Grafana+2 · Grafana Enterprise+3

Published 2021-03-22 · Updated 2024-06-15 · CVE-2021-28148

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Grafana Enterprise versions 6.x through 6.7.5 Grafana Enterprise versions 7.x through 7.3.9 Grafana Enterprise versions 7.4.x through 7.4.4

Description: One of the usage insights HTTP API endpoints in Grafana Enterprise is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.

Recommendations: For versions 6.x through 6.7.5, update to version 6.7.6 or later. For versions 7.x through 7.3.9, update to version 7.3.10 or later. For versions 7.4.x through 7.4.4, update to version 7.4.5 or later.

Exploit

Fix

DoS

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

ALT-PU-2021-1708

ALT-PU-2022-1177

ALT-PU-2022-1249

BIT-GRAFANA-2021-28148

CVE-2021-28148

OESA-2021-1445

OPENSUSE-SU-2021:1148-1

OPENSUSE-SU-2021:1162-1

OPENSUSE-SU-2021:2662-1

OPENSUSE-SU-2021:2675-1

OPENSUSE-SU-2021_1148-1

OPENSUSE-SU-2021_1162-1

OPENSUSE-SU-2021_2662-1

OPENSUSE-SU-2021_2675-1

OPENSUSE-SU-2024:10818-1

SUSE-SU-2021:2660-1

SUSE-SU-2021:2673-1

SUSE-SU-2021:2675-1

SUSE-SU-2021:3907-1

SUSE-SU-2021:3908-1

Affected Products

Alt Linux

Grafana

Grafana Enterprise

Suse

References · 75

• 🔥 https://github.com/jas502n/Grafana-CVE-2021-43798 · Exploit
• 🔥 https://github.com/pedrohavay/exploit-grafana-CVE-2021-43798 · Exploit
• 🔥 https://github.com/taythebot/CVE-2021-43798 · Exploit
• 🔥 https://github.com/zer0yu/CVE-2021-43798 · Exploit
• 🔥 https://github.com/Mr-xn/CVE-2021-43798 · Exploit
• 🔥 https://github.com/ScorpionsMAX/CVE-2021-43798-Grafana-POC · Exploit
• 🔥 https://github.com/j-jasson/CVE-2021-43798-grafana_fileread · Exploit
• 🔥 https://github.com/M0ge/CVE-2021-43798-grafana_fileread · Exploit
• 🔥 https://github.com/asaotomo/CVE-2021-43798-Grafana-Exp · Exploit
• 🔥 https://github.com/culprits/Grafana_POC-CVE-2021-43798 · Exploit
• 🔥 https://github.com/Mo0ns/Grafana_POC-CVE-2021-43798 · Exploit
• 🔥 https://github.com/z3n70/CVE-2021-43798 · Exploit
• 🔥 https://github.com/K3ysTr0K3R/CVE-2021-43798-EXPLOIT · Exploit
• 🔥 https://github.com/rodpwn/CVE-2021-43798-mass_scanner · Exploit
• 🔥 https://github.com/s1gh/CVE-2021-43798 · Exploit