CVE-2021-27962

概要

参考情報

• openwall.com/lists/oss-security/2021/03/19/5 · Mailing List
• community.grafana.com · Vendor Advisory
• community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724 · Release Notes
• community.grafana.com/t/release-notes-v6-7-x/27119 · Release Notes
• grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise · Release Notes
• grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5 · Release Notes

grafana のその他の脆弱性

• CVE-2026-14199高 8.1Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. T…
• CVE-2026-8609高 7.5An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eve…
• CVE-2026-8595中 5.4A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script i…
• CVE-2026-33382高 7.5Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can…
• CVE-2026-28378低 2.7The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public d…