CVE-2021-28148

Name of the Vulnerable Software and Affected Versions: Grafana Enterprise versions 6.x through 6.7.5 Grafana Enterprise versions 7.x through 7.3.9 Grafana Enterprise versions 7.4.x through 7.4.4

Description: One of the usage insights HTTP API endpoints in Grafana Enterprise is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.

Recommendations: For versions 6.x through 6.7.5, update to version 6.7.6 or later. For versions 7.x through 7.3.9, update to version 7.3.10 or later. For versions 7.4.x through 7.4.4, update to version 7.4.5 or later.