Insecure Access Control

🗓️ 29 Apr 2021 12:05:21Reported by Veracode Vulnerability DatabaseType

Insecure Access Control in Grafana Enterprise HTTP API allowing unauthorized user team permissions modification

Reporter	Title	Published	Views	Family All 41
AlpineLinux	CVE-2021-28147	22 Mar 202114:03	–	alpinelinux
Circl	CVE-2021-28147	22 Mar 202117:37	–	circl
CNNVD	Grafana Labs Grafana Enterprise 安全漏洞	18 Mar 202100:00	–	cnnvd
CVE	CVE-2021-28147	22 Mar 202114:03	–	cve
Cvelist	CVE-2021-28147	22 Mar 202114:03	–	cvelist
EUVD	EUVD-2021-14845	7 Oct 202500:30	–	euvd
NCSC	Vulnerabilities fixed in Grafana Enterprise	22 Mar 202100:00	–	ncsc
NVD	CVE-2021-28147	22 Mar 202115:15	–	nvd
Tenable Nessus	openSUSE 15 Security Update : grafana (openSUSE-SU-2021:1148-1)	14 Aug 202100:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : SUSE Manager Client Tools (openSUSE-SU-2021:1162-1)	18 Aug 202100:00	–	nessus

Vulners

Node

grafana grafanaMatch6.7.2-r0os

AND

grafana grafanaMatch6.6.2-r0os

AND

grafana grafanaMatch6.7.1-r0os

AND

grafana grafanaMatch7.4.3-r0os

AND

grafana grafanaMatch6.7.3-r1os

AND

grafana grafanaMatch6.7.0-r0os

AND

grafana grafanaMatch6.7.3-r0os

AND

Source	Link
secdb	www.secdb.alpinelinux.org/edge/community.yaml
community	www.community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
community	www.community.grafana.com/t/release-notes-v6-7-x/27119
grafana	www.grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
grafana	www.grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/
grafana	www.grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/
grafana	www.grafana.com/products/enterprise/
security	www.security.netapp.com/advisory/ntap-20210430-0005/
openwall	www.openwall.com/lists/oss-security/2021/03/19/5

20 May 2022 23:35Current

1.1Low risk

Vulners AI Score1.1

CVSS 23.5

CVSS 3.16.5

EPSS0.00461