The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to
    bypass a permission check concerning a data source they should not be able to access. (CVE-2021-27962)

  - The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On
    Grafana instances using an external authentication service, this vulnerability allows any authenticated
    user to add external groups to existing teams. This can be used to grant a user team permissions that the
    user isn't supposed to have. (CVE-2021-28146)

  - The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5
    has an Incorrect Access Control issue. On Grafana instances using an external authentication service and
    having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add
    external groups to any existing team. This can be used to grant a user team permissions that the user
    isn't supposed to have. (CVE-2021-28147)

  - One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10,
    and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to
    send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against
    a Grafana Enterprise instance. (CVE-2021-28148)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1162-1 advisory.

  - Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to     bypass a permission check concerning a data source they should not be able to access. (CVE-2021-27962)

  - The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On     Grafana instances using an external authentication service, this vulnerability allows any authenticated     user to add external groups to existing teams. This can be used to grant a user team permissions that the     user isn't supposed to have. (CVE-2021-28146)

  - The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5     has an Incorrect Access Control issue. On Grafana instances using an external authentication service and     having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add     external groups to any existing team. This can be used to grant a user team permissions that the user     isn't supposed to have. (CVE-2021-28147)

  - One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10,     and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to     send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against     a Grafana Enterprise instance. (CVE-2021-28148)

  - Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its     default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due     to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL,     in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be     redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the     /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy     in front of Prometheus. (CVE-2021-29622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1148-1 advisory.

  - The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to     trigger a Denial of Service via a remote API call if a commonly used configuration is set.
    (CVE-2021-27358)

  - Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to     bypass a permission check concerning a data source they should not be able to access. (CVE-2021-27962)

  - The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On     Grafana instances using an external authentication service, this vulnerability allows any authenticated     user to add external groups to existing teams. This can be used to grant a user team permissions that the     user isn't supposed to have. (CVE-2021-28146)

  - The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5     has an Incorrect Access Control issue. On Grafana instances using an external authentication service and     having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add     external groups to any existing team. This can be used to grant a user team permissions that the user     isn't supposed to have. (CVE-2021-28147)

  - One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10,     and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to     send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against     a Grafana Enterprise instance. (CVE-2021-28148)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2662-1 advisory.

  - The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to     trigger a Denial of Service via a remote API call if a commonly used configuration is set.
    (CVE-2021-27358)

  - Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to     bypass a permission check concerning a data source they should not be able to access. (CVE-2021-27962)

  - The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On     Grafana instances using an external authentication service, this vulnerability allows any authenticated     user to add external groups to existing teams. This can be used to grant a user team permissions that the     user isn't supposed to have. (CVE-2021-28146)

  - The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5     has an Incorrect Access Control issue. On Grafana instances using an external authentication service and     having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add     external groups to any existing team. This can be used to grant a user team permissions that the user     isn't supposed to have. (CVE-2021-28147)

  - One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10,     and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to     send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against     a Grafana Enterprise instance. (CVE-2021-28148)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2675-1 advisory.

  - Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to     bypass a permission check concerning a data source they should not be able to access. (CVE-2021-27962)

  - The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On     Grafana instances using an external authentication service, this vulnerability allows any authenticated     user to add external groups to existing teams. This can be used to grant a user team permissions that the     user isn't supposed to have. (CVE-2021-28146)

  - The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5     has an Incorrect Access Control issue. On Grafana instances using an external authentication service and     having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add     external groups to any existing team. This can be used to grant a user team permissions that the user     isn't supposed to have. (CVE-2021-28147)

  - One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10,     and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to     send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against     a Grafana Enterprise instance. (CVE-2021-28148)

  - Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its     default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due     to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL,     in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be     redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the     /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy     in front of Prometheus. (CVE-2021-29622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
404798	Alpine: multiple grafana packages: security update to 7.4.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404798	Alpine: multiple grafana packages: security update to 7.4.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400257	Alpine: multiple grafana packages: security update to 7.4.3-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400257	Alpine: multiple grafana packages: security update to 7.4.3-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
152647	openSUSE 15 Security Update : SUSE Manager Client Tools (openSUSE-SU-2021:1162-1)	Nessus	SuSE Local Security Checks	high
152561	openSUSE 15 Security Update : grafana (openSUSE-SU-2021:1148-1)	Nessus	SuSE Local Security Checks	high
152554	openSUSE 15 Security Update : grafana (openSUSE-SU-2021:2662-1)	Nessus	SuSE Local Security Checks	high
152552	openSUSE 15 Security Update : SUSE Manager Client Tools (openSUSE-SU-2021:2675-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-28147

medium

Tenable Plugins

high

high

high

high

high

high

high

high