One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade grafana | Aug 22, 2024 | Mar 22, 2021 |
| Suse | — | Upgrade python3-rhnlibUpgrade python3-mgr-osa-dispatcherUpgrade python2-mgr-osa-dispatcherUpgrade mgr-osadUpgrade python2-suseregisterinfoUpgrade python3-mgr-cfgUpgrade python3-mgr-virtualization-commonUpgrade ansibleUpgrade python3-suseregisterinfoUpgrade python3-spacewalk-oscapUpgrade python3-mgr-cfg-actionsUpgrade golang-github-prometheus-prometheusUpgrade ansible-docUpgrade python2-rhnlibUpgrade python3-spacewalk-koanUpgrade mgr-pushUpgrade spacewalk-koanUpgrade python3-spacewalk-checkUpgrade python2-mgr-cfg-managementUpgrade spacewalk-oscapUpgrade python2-mgr-virtualization-hostUpgrade python2-mgr-cfgUpgrade mgr-cfg-managementUpgrade python3-mgr-pushUpgrade python3-spacewalk-client-setupUpgrade grafanaUpgrade mgr-cfg-actionsUpgrade spacewalk-client-setupUpgrade python3-spacewalk-client-toolsUpgrade mgr-cfg-clientUpgrade python3-uyuni-common-libsUpgrade python3-mgr-osadUpgrade python3-mgr-cfg-managementUpgrade python2-spacewalk-koanUpgrade python2-mgr-cfg-actionsUpgrade mgr-cfgUpgrade python2-mgr-cfg-clientUpgrade python2-mgr-osadUpgrade python2-mgr-virtualization-commonUpgrade python2-mgr-pushUpgrade mgr-custom-infoUpgrade python2-uyuni-common-libsUpgrade python2-mgr-osa-commonUpgrade mgr-osa-dispatcherUpgrade dracut-saltbootUpgrade python3-mgr-osa-commonUpgrade python2-spacewalk-client-toolsUpgrade suseregisterinfoUpgrade ansible-testUpgrade spacecmdUpgrade spacewalk-client-toolsUpgrade python2-spacewalk-oscapUpgrade python3-mgr-cfg-clientUpgrade python3-mgr-virtualization-hostUpgrade spacewalk-checkUpgrade python2-spacewalk-client-setupUpgrade python2-spacewalk-checkUpgrade mgr-virtualization-host | Aug 13, 2021 | Mar 22, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub