AEGLIX vulnerability intelligence
CVE-2021-39226
CRITICAL · CVSS 9.8 · Analyzed
Published: 2021-10-05 · Updated: 2026-06-17 · Source: NVD
Vulnerability overview
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.
Severity and scoring
- CVSS score
- 9.8 · CRITICAL
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-287, CWE-862
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Grafana Labs · Grafana
- Added to catalog
- 2022-08-25
- Required action
- Apply updates per vendor instructions.
- CISA remediation due date
- 2022-09-15
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
Before (exclusive): 7.5.11
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
From (inclusive): 8.0.0
Before (exclusive): 8.1.6
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://www.openwall.com/lists/oss-security/2021/10/05/4
Mailing List · Third Party Advisory
- https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269
Patch
- https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9
Exploit · Mitigation · Vendor Advisory
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/
Release Notes
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/
Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT/
Broken Link
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/
Broken Link
- https://security.netapp.com/advisory/ntap-20211029-0008/
Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/05/4
Mailing List · Third Party Advisory
- https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269
Patch
- https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9
Exploit · Mitigation · Vendor Advisory
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/
Release Notes
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/
Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT/
Broken Link
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/
Broken Link
- https://security.netapp.com/advisory/ntap-20211029-0008/
Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39226
US Government Resource