Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 99.9%; technical severity is CVSS 7.3.
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.
Who should care
- Teams operating Fedora, Grafana
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Fedora, Grafana is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- GitHub Security patch 2d456a6375855364d098ede379438bf7f0667269
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Upgrade
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CWE
- CWE-287
- Affected versions
- Fedoraproject Fedora (Version 34 | Version 35); Grafana Grafana (End Excluding 7.5.11 | Start Including 8.0.0, End Excluding 8.1.6); Grafana Labs Grafana
- Fixed versions
- Grafana Grafana (Fixed from 7.5.11, 8.1.6)
- Published
- 5 October 2021
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 99.9%
- Signal calculated at 82
External references
- CISA Government advisory CVE-2021-39226
- GitHub Technical reference GHSA 69j6 29vr P3j9
- Openwall Third-party advisory
- Lists Fedoraproject Technical reference DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT
- Lists Fedoraproject Technical reference E6ANHRDBXQT6TURLP2THM26ZPDINFBEG
- Security Netapp Third-party advisory Ntap 20211029 0008