Vulnerabilities > CVE-2021-27962 - Unspecified vulnerability in Grafana
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
SINGLE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
NONE network
grafana
Summary
Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.
Vulnerable Configurations
References
- http://www.openwall.com/lists/oss-security/2021/03/19/5
- https://community.grafana.com
- https://community.grafana.com/t/release-notes-v6-7-x/27119
- https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
- https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/