CVE - CVE-2021-39226

CVE-ID
CVE-2021-39226	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://security.netapp.com/advisory/ntap-20211029-0008/ CONFIRM:https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9 URL:https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9 FEDORA:FEDORA-2021-01588ab0bf URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT/ FEDORA:FEDORA-2021-dd83dc8b0b URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/ MISC:https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 URL:https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 MISC:https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/ URL:https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/ MISC:https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/ URL:https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/ MLIST:[oss-security] 20211005 CVE-2021-39226 Grafana snapshot authentication bypass URL:http://www.openwall.com/lists/oss-security/2021/10/05/4
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20210816	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20210816)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)