CVEvulnerability
CVE-2021-27962
7.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-03-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.9 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:N
Description
Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.
Affected configurations
• grafana grafana (>= 7.2.0 < 7.3.10)
• grafana grafana (>= 7.4.0 < 7.4.5)
References
- http://www.openwall.com/lists/oss-security/2021/03/19/5 Mailing List, Third Party Advisory
- https://community.grafana.com Vendor Advisory
- https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724 Release Notes, Vendor Advisory
- https://community.grafana.com/t/release-notes-v6-7-x/27119 Release Notes, Vendor Advisory
- https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/ Release Notes, Vendor Advisory
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/ Release Notes, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2021/03/19/5 Mailing List, Third Party Advisory
- https://community.grafana.com Vendor Advisory
- https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724 Release Notes, Vendor Advisory
- https://community.grafana.com/t/release-notes-v6-7-x/27119 Release Notes, Vendor Advisory
- https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/ Release Notes, Vendor Advisory
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/ Release Notes, Vendor Advisory