Differential D32667 Diff 97470 security/vuxml/vuln-2021.xml

Changeset View

Standalone View

security/vuxml/vuln-2021.xml

This file is larger than 256 KB, so syntax highlighting is disabled by default.

				<vuln vid="757ee63b-269a-11ec-a616-6c3be5272acd">
				<topic>Grafana -- Snapshot authentication bypass</topic>
				<affects>
				<package>
				<name>grafana8</name>
				<name>grafana7</name>
				<name>grafana6</name>
				<name>grafana</name>
				<range><ge>8.0.0</ge><lt>8.1.6</lt></range>
				<range><ge>2.0.1</ge><lt>7.5.11</lt></range>
				</package>
				</affects>
				<description>
				<body xmlns="http://www.w3.org/1999/xhtml">
				<p>Grafana Labs reports:</p>
				<blockquote cite="https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/">
				<p>Unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths:</p>
				<ul>
				<li><code>/dashboard/snapshot/:key</code>, or</li>
				<li><code>/api/snapshots/:key</code></li>
				</ul>
				<p>If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path:</p>
				<ul>
				<li><code>/api/snapshots-delete/:deleteKey</code></li>
				</ul>
				<p>Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths:</p>
				<ul>
				<li><code>/api/snapshots/:key</code>, or</li>
				<li><code>/api/snapshots-delete/:deleteKey</code></li>
				</ul>
				<p>The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.</p>
				</blockquote>
				</body>
				</description>
				<references>
				<cvename>CVE-2021-39226</cvename>
				<url>https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/</url>
				</references>
				<dates>
				<discovery>2021-09-15</discovery>
				<entry>2021-10-06</entry>
				</dates>
				</vuln>

	<vuln vid="f4b15f7d-d33a-4cd0-a97b-709d6af0e43e">			<vuln vid="f4b15f7d-d33a-4cd0-a97b-709d6af0e43e">
	<topic>minio -- policy restriction issue</topic>			<topic>minio -- policy restriction issue</topic>
	<affects>			<affects>
	<package>			<package>
	<name>minio</name>			<name>minio</name>
	<range><lt>2021.10.23.03.28.24</lt></range>			<range><lt>2021.10.23.03.28.24</lt></range>
	</package>			</package>
	</affects>			</affects>
	▲ Show 20 Lines • Show All 10,204 Lines • Show Last 20 Lines