CVE-2021-28147

· MEDIUMModified

← All CVEs

CVSS v3.1

6.5

EPSS

1.61%

Published

Mar 22, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected Products (3)

grafana · grafana (up to 6.7.6)vulnerable

grafana · grafana (up to 7.3.10)vulnerable

grafana · grafana (up to 7.4.5)vulnerable

References (16)

https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724

Vendor Advisory

https://community.grafana.com/t/release-notes-v6-7-x/27119

Release NotesVendor Advisory

https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/