CVE-2021-39226 · netVigilance record NV22-0495
Grafana Authentication Bypass
past due
What to do
Apply updates per vendor instructions.
CISA deadline 2022-09-15 · passed 3 years 11 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA
What happened
Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.
Who is affected
Grafana Labs Grafana. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.
Weakness class: CWE-287.
Timeline
- Added to CISA KEVExploitation in the wild confirmed by CISA
- CISA remediation deadlinepassed 3 years 11 months ago
Sources
- NVD entry for CVE-2021-39226 nvd.nist.gov/vuln/detail/CVE-2021-39226
- CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
- grafana.com grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/
- nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2021-39226