CVE-2021-27358

HIGH8.2EPSS 92.4%

Denial of service in Grafana

發布日:2022/2/15修改日:2025/4/3

描述

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

受影響套件(2)

Bitnami/grafana>= 6.7.3, < 7.4.2
Go/github.com/grafana/grafana>= 6.7.3, < 7.4.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:R

參考連結(8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-27358
WEBhttps://github.com/grafana/grafana/blob/master/CHANGELOG.md
WEBhttps://github.com/grafana/grafana/blob/master/CHANGELOG.md#742-2021-02-17
WEBhttps://github.com/grafana/grafana/pull/31263
WEBhttps://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2
WEBhttps://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/
WEBhttps://security.netapp.com/advisory/ntap-20210513-0007
WEBhttps://security.netapp.com/advisory/ntap-20210513-0007/