CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2021-10-05
Grafana Unauthenticated Snapshot Data Exposure and Deletion Vulnerability (CVE-2021-39226)
[Affected Scope] Grafana versions prior to 8.1.6 and 7.5.11
[Impact] Unauthenticated attackers can view or delete the snapshot with the lowest database key via specific API paths, potentially leading to complete snapshot data harvesting and loss.
[Mitigation] Immediately upgrade Grafana to patched versions (8.1.6, 7.5.11, or higher) or block access to the vulnerable API paths using a reverse proxy.