CVE-2021-27358

Aliases:GHSA-h5rh-w6vm-9ghcBIT-grafana-2021-27358
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 18 Mar 2021, 19:43
Last modified:03 Aug 2024, 20:48

Vulnerability Summary

Overall Risk (default)
medium
48/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
92.4% CRITICAL
92% probability +6.20%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

18 Mar 2021, 19:43
Published
Vulnerability first disclosed
03 Aug 2024, 20:48
Last Modified
Vulnerability information updated

Description

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v3.1•HIGH•Score: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:R
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 92.40%• Percentile: 100%

Affected Systems

  • github.com/grafana•grafana

    ≥ 6.7.3, < 7.4.2

  • grafana•grafana

    ≥ 6.7.3, ≤ 7.4.1

  • netapp•e-series_performance_analyzer

    na

References (8)