SUSE update for grafana



| Updated: 2022-09-03
Risk Medium
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2021-27358
CVE-2021-27962
CVE-2021-28146
CVE-2021-28147
CVE-2021-28148
CWE-ID CWE-400
CWE-269
CWE-284
CWE-799
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 SUSE Manager Tools
Operating systems & Components / Operating system

grafana
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Resource exhaustion

EUVDB-ID: #VU64406

Risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2021-27358

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in Grafana when anonymous access is enabled. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack via a remote API call.

Mitigation

Update the affected package grafana to the latest version.

Vulnerable software versions

SUSE Manager Tools: 15 BETA

grafana: before 7.5.7-1.21.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2021/suse-su-20212660-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Improper Privilege Management

EUVDB-ID: #VU51579

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-27962

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges within the application.

The vulnerability exists due to improper privilege management. A remote user with Editor privileges can bypass data source permissions on the organization's default data source.

Mitigation

Update the affected package grafana to the latest version.

Vulnerable software versions

SUSE Manager Tools: 15 BETA

grafana: before 7.5.7-1.21.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2021/suse-su-20212660-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper access control

EUVDB-ID: #VU51580

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-28146

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and add external groups to existing teams.

Mitigation

Update the affected package grafana to the latest version.

Vulnerable software versions

SUSE Manager Tools: 15 BETA

grafana: before 7.5.7-1.21.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2021/suse-su-20212660-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU51581

Risk: Medium

CVSSv4.0: 1.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-28147

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions, when editorsCanAdmin  feature is enabled. A remote user can bypass implemented security restrictions and add external group members to existing teams.

Mitigation

Update the affected package grafana to the latest version.

Vulnerable software versions

SUSE Manager Tools: 15 BETA

grafana: before 7.5.7-1.21.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2021/suse-su-20212660-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper control of interaction frequency

EUVDB-ID: #VU51582

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-28148

CWE-ID: CWE-799 - Improper Control of Interaction Frequency

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to absent control of interaction frequency within the HTTP API endpoint for insights usage. A remote non-authenticated attacker send multiple HTTP requests and perform a denial of service (DoS) attack.

Mitigation

Update the affected package grafana to the latest version.

Vulnerable software versions

SUSE Manager Tools: 15 BETA

grafana: before 7.5.7-1.21.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2021/suse-su-20212660-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###