Description

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.

Remediation

References

CVE-2021-28148

Related Vulnerabilities

WordPress Plugin Ad-Manager Open Redirect (1.1.2)

WordPress 4.8.x Multiple Vulnerabilities (4.8 - 4.8.14)

XWiki URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-29204)

WordPress Plugin Dialog Contact Form Cross-Site Scripting (1.2.0)

OpenSSL Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2022-2068)

Severity

High

Classification

CVE-2021-28148 CWE-287 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities