CVE-2021-27962 | Vulnerability Database | Aqua Security

Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.

Affected Software

Name	Vendor	Start Version	End Version
Grafana	Grafana	7.2.0 (including)	7.3.10 (excluding)
Grafana	Grafana	7.4.0 (including)	7.4.5 (excluding)
Grafana	Ubuntu	trusty	*

References

http://www.openwall.com/lists/oss-security/2021/03/19/5
https://community.grafana.com
https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
https://community.grafana.com/t/release-notes-v6-7-x/27119
https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/
http://www.openwall.com/lists/oss-security/2021/03/19/5
https://community.grafana.com
https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
https://community.grafana.com/t/release-notes-v6-7-x/27119
https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/

NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-27962
CWE	https://cwe.mitre.org/data/definitions/.html