CVE-2021-28148

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any…

published March 22, 2021

CVSS
—
EPSS
3%
Percentile
89.1
In the wild
Unconfirmed
What it is

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03497 · 89.1th percentile
Published
2021-03-22T14:06Z
EPSS history
Timeline
  • 22 MAR 14:06Z
    One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any…
    cvelistv5