CVE-2021-39226

Grafana Authentication Bypass Vulnerability

Grafana

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path…

5. Okt 2021

Ausgewertete Quellen

• Hinweis
  http://www.openwall.com/lists/oss-security/2021/10/05/4
• Hinweis
  https://security.netapp.com/advisory/ntap-20211029-0008/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39226
• CISA
  Grafana Authentication Bypass Vulnerability
• NVD
  CVE-2021-39226
• GitHub
  https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9