{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-39226/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-39226/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-39226/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-39226/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-39226/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-39226"},"sightings":{"href":"/api/v1/sightings/cve-2021-39226"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-39226.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2021-39226\n\ninfo:\n  name: Grafana Snapshot - Authentication Bypass\n  author: Evan Rubinstein,matejsmycka\n  severity: high\n  description: Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by accessing the endpoint /api/snapshots-delete/:deleteKey. Authenticated users can also delete snapshots by accessing the endpoints /api/snapshots-delete/:deleteKey, or sending a delete request to /api/snapshot/:key, regardless of whether or not the snapshot is set to public mode (disabled by default).\n  impact: |\n    An attacker can bypass authentication and gain unauthorized access to Grafana Snapshot feature.\n  remediation: 'This issue has been resolved in versions 8.1.6 and 7.5.11. If you cannot upgrade you can block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.'\n  reference:\n    - https://github.com/advisories/GHSA-69j6-29vr-p3j9\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-39226\n    - https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269\n    - https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/\n    - http://www.openwall.com/lists/oss-security/2021/10/05/4\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n    cvss-score: 7.3\n    cve-id: CVE-2021-39226\n    cwe-id: CWE-287\n    epss-score: 0.99933\n    epss-percentile: 0.9997\n    cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: grafana\n    product: grafana\n    shodan-query:\n      - title:\"Grafana\"\n      - cpe:\"cpe:2.3:a:grafana:grafana\"\n      - http.title:\"grafana\"\n    fofa-query:\n      - title=\"grafana\"\n      - app=\"grafana\"\n    google-query: intitle:\"grafana\"\n  tags: cve2021,cve,grafana,kev,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/snapshots/:key\"\n      - \"{{BaseURL}}/dashboard/snapshot/:key\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - '\"isSnapshot\":true'\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450221008095bcc86d680164c22c5cb1387a6cbd6740d07eaceb00c0802c74c28c08ad4a022031fece9488c7d8ee8cbcc6ee5a02dd9966ddd3bfeaf40f802b964639ea7d6e87:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-39226"}