.. / CVE-2021-27358

Exploit for Grafana Unauthenticated Snapshot Creation (CVE-2021-27358)

Description:

Grafana 6.7.3 through 7.4.1 snapshot functionality can allow an unauthenticated remote attacker to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

Nuclei Template

View the template here CVE-2021-27358.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-27358.yaml
Copy

References:

https://github.com/grafana/grafana/blob/master/CHANGELOG.md
https://nvd.nist.gov/vuln/detail/CVE-2021-27358
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/
https://github.com/grafana/grafana/blob/master/CHANGELOG.md#742-2021-02-17
https://phabricator.wikimedia.org/T274736