CVEvulnerability
CVE-2021-28148
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-03-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-306
Description
One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.
Affected configurations
• grafana grafana (>= 6.0.0 < 6.7.6)
• grafana grafana (>= 7.0.0 < 7.3.10)
• grafana grafana (>= 7.4.0 < 7.4.5)
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724 Vendor Advisory
- https://community.grafana.com/t/release-notes-v6-7-x/27119 Release Notes, Vendor Advisory
- https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/ Release Notes, Vendor Advisory
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/ Release Notes, Vendor Advisory
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/ Release Notes, Vendor Advisory
- https://grafana.com/products/enterprise/ Product, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20210430-0005/ Third Party Advisory
- https://www.openwall.com/lists/oss-security/2021/03/19/5 Mailing List, Third Party Advisory
- https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724 Vendor Advisory
- https://community.grafana.com/t/release-notes-v6-7-x/27119 Release Notes, Vendor Advisory
- https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/ Release Notes, Vendor Advisory
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/ Release Notes, Vendor Advisory
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/ Release Notes, Vendor Advisory
- https://grafana.com/products/enterprise/ Product, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20210430-0005/ Third Party Advisory
- https://www.openwall.com/lists/oss-security/2021/03/19/5 Mailing List, Third Party Advisory