6.8
CVSSv2

CVE-2021-39226

Published: 05/10/2021 Updated: 19/10/2021
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
CVSS v3 Base Score: 7.3 | Impact Score: 3.4 | Exploitability Score: 3.9
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

grafana grafana

Vendor Advisories

No description is available for this CVE ...
A security issue has been found in Grafana before version 816 Unauthenticated and authenticated users are able to view the snapshot with the lowest database key If the snapshot “public_mode” configuration setting is set to true (vs default or false), unauthenticated users are able to delete the snapshot with the lowest database key Regard ...

Mailing Lists

Today we are releasing Grafana 7511, and 816 These patch releases include an important security fix for an issue that affects all Grafana versions from 201 [Grafana Cloud](grafanacom/cloud) instances have already been patched and an audit did not find any usage of this attack vector [Grafana Enterprise](grafanacom/produc ...