Description

Grafana has an authentication bypass vulnerability. An attacker can view without authentication the Grafana's snapshot associated with the lowest database key .

Remediation

Upgrade to the latest version of Grafana

References

Authentication bypass for viewing and deletions of snapshots

Related Vulnerabilities

Internet Information Services Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2002-1718)

MediaWiki Incorrect Default Permissions Vulnerability (CVE-2017-0369)

Jenkins Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2018-1999044)

Internet Information Services Other Vulnerability (CVE-2001-1243)

WebLogic CVE-2019-2645 Vulnerability (CVE-2019-2645)

Severity

High

Classification

CVE-2021-39226 CWE-287 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Authentication Bypass Known Vulnerabilities