CVE-2021-39226

一、漏洞信息
 漏洞编号：[CVE-2021-39226](https://nvd.nist.gov/vuln/detail/CVE-2021-39226)
 漏洞归属组件：[grafana](https://gitee.com/src-openeuler/grafana)
 漏洞归属的版本：6.7.4,7.3.6
 CVSS V3.0分值：
  BaseScore：7.3 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
 漏洞简述：
  Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot  public_mode  configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot  public_mode  setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.
 漏洞公开时间：2021-10-06 02:15
 漏洞创建时间：2021-10-09 00:10:29
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-39226
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| MISC | https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 |  |
| MISC | https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/ |  |
| CONFIRM | https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9 |  |
| MISC | https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/ |  |
| MLIST | http://www.openwall.com/lists/oss-security/2021/10/05/4 |  |
| FEDORA | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/ |  |
| CONFIRM | https://security.netapp.com/advisory/ntap-20211029-0008/ |  |
| FEDORA | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT/ |  |
| redhat | https://access.redhat.com/security/cve/CVE-2021-39226 |  |
| suse_bugzilla | https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 |  |
| suse_bugzilla | https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/ |  |
| suse_bugzilla | https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9 |  |
| suse_bugzilla | https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/ |  |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2011063 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39226 |  |
| suse_bugzilla | http://www.openwall.com/lists/oss-security/2021/10/05/4 |  |
| suse_bugzilla | http://seclists.org/oss-sec/2021/q4/9 |  |
| suse_bugzilla | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39226 |  |
| suse_bugzilla | https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 |  |
| suse_bugzilla | https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9 |  |
| suse_bugzilla | https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/ |  |
| suse_bugzilla | https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/ |  |
| redhat_bugzilla | https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 |  |
| redhat_bugzilla | https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/ |  |
| redhat_bugzilla | https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9 |  |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39226 |  |
| ubuntu | https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9 |  |
| ubuntu | https://www.openwall.com/lists/oss-security/2021/10/05/4 |  |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2021-39226 |  |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2021-39226 |  |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2021-39226 |  |
| debian | https://security-tracker.debian.org/tracker/CVE-2021-39226 |  |
| oracle | https://www.oracle.com/security-alerts/linuxbulletinoct2021.html |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 |  | MISC |
|  |  | https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 |  | suse_bugzilla |
|  |  | https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 |  | redhat_bugzilla |
|  |  | https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    Grafana 是一个开源数据可视化平台。在受影响的版本中，未经身份验证和经过身份验证的用户可以通过访问文字路径查看具有最低数据库密钥的快照:/dashboard/snapshot/:key 或 /api/snapshots/:key。如果快照“public_mode”配置设置为 true（与默认为 false），未经身份验证的用户可以通过访问文字路径:/api/snapshots-delete/:deleteKey 删除具有最低数据库键的快照。无论快照“public_mode”设置如何，经过身份验证的用户都可以通过访问文字路径:/api/snapshots/:key 或 /api/snapshots-delete/:deleteKey 删除具有最低数据库密钥的快照。删除和查看相结合，可以完整地遍历所有快照数据，同时导致完整的快照数据丢失。此问题已在版本 8.1.6 和 7.5.11 中得到解决。如果由于某种原因您无法升级，您可以使用反向代理或类似工具来阻止对文字路径的访问:/api/snapshots/:key、/api/snapshots-delete/:deleteKey、/dashboard/snapshot/:key 和/api/snapshots/:key. 它们没有正常功能，可以禁用而不会产生副作用。 
 openEuler评分：
  7.3
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.master(7.3.6):受影响
2.openEuler-20.03-LTS-Next(7.3.6):受影响
3.openEuler-20.03-LTS-SP1(7.3.6):受影响
4.openEuler-20.03-LTS-SP2(7.3.6):受影响
5.openEuler-20.03-LTS-SP3(7.3.6):受影响

修复是否涉及abi变化(是/否)：
  1.master(7.3.6):否
2.openEuler-20.03-LTS-Next(7.3.6):否
3.openEuler-20.03-LTS-SP1(7.3.6):否
4.openEuler-20.03-LTS-SP2(7.3.6):否
5.openEuler-20.03-LTS-SP3(7.3.6):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2022-1929

src-openEuler/grafana

内容风险标识

评论 (9)

src-openEuler/grafana .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-39226

评论 (9)

搜索帮助

src-openEuler/grafana