CVE-2021-27358: 
Grafana vulnerability analysis and mitigation

The vulnerability (CVE-2021-27358) affects Grafana versions 6.7.3 through 7.4.1. The issue lies in the snapshot feature, which allows unauthenticated remote attackers to trigger a Denial of Service (DoS) via a remote API call when a commonly used configuration is set. The vulnerability was disclosed and patched in February 2021 (Grafana Changelog, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This scoring indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and can result in high availability impact while not affecting confidentiality or integrity (NVD).

Successful exploitation of this vulnerability could lead to a Denial of Service (DoS) condition, potentially making the Grafana service unavailable to legitimate users. The vulnerability specifically affects the snapshot feature when certain common configurations are in place (NetApp Security).

The vulnerability is exploitable remotely by unauthenticated attackers through a remote API call. No special privileges or user interaction is required for exploitation. Public discussions about this vulnerability have been acknowledged by security researchers and vendors (NetApp Security).

The vulnerability was fixed in Grafana version 7.4.2. Users are advised to upgrade to this version or later to mitigate the risk. The security fix specifically prevents anonymous users from creating snapshots (Grafana Release Notes).