Headline

GHSA-wm7r-3qxj-5xgq: Grafana Improper Access Control vulnerability

Grafana is an open-source platform for monitoring and observability.

The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.

This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.

Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

1 year ago

ghsa

Open in Source

#vulnerability #git

- Actions
  
  Automate any workflow
- Packages
  
  Host and manage packages
- Security
  
  Find and fix vulnerabilities
- Codespaces
  
  Instant dev environments
- Copilot
  
  Write better code with AI
- Code review
  
  Manage code changes
- Issues
  
  Plan and track work
- Discussions
  
  Collaborate outside of code

- GitHub Sponsors
  
  Fund open source developers

*   The ReadME Project
    
    GitHub community articles

Pricing

GitHub Advisory Database
GitHub Reviewed
CVE-2023-2183

Grafana Improper Access Control vulnerability

Moderate severity GitHub Reviewed Published Jun 6, 2023 to the GitHub Advisory Database • Updated Jun 7, 2023

Package

gomod github.com/grafana/grafana (Go)

Affected versions

< 8.5.26

>= 9.0.0, < 9.2.19

>= 9.3.0, < 9.3.15

>= 9.4.0, < 9.4.12

>= 9.5.0, < 9.5.3

Patched versions

8.5.26

9.2.19

9.3.15

9.4.12

9.5.3

Description

Published to the GitHub Advisory Database

Jun 6, 2023

### Summary Grafana allows an attacker in the Viewer role, send alerts by API Alert - Test. The option is not available from the user panel UI for in the Viewer role. **Reason for the error**: The API does not check access to this function and allows it by users with the least rights, for example, the Viewer that does not see this option in the user panel. This enables malicious users to abuse the functionality by sending multiple alert messages (e-mail, slack, etc…), spamming users, prepare Phishing attack or blocked SMTP server / IP and automatically moved all message to spam folder, add to black list IP. ### Details The logged-in user, in the Viewer role, in the user panel, does not have access to the test option of sending an e-mail alert. View of the panel for the user in the Viewer role: ![image](https://user-images.githubusercontent.com/1643385/232904030-e8a8338d-f5e3-4b04-80c3-32f2164a190e.png) Admin role - View panel for admin role: ![image](https://user-images.github...

1 year ago

ghsa

Open in Source

#xss #web #mac #windows #apple #js #git #chrome #webkit

CVE-2023-2183: Broken Access Control in Alert manager | Grafana Labs

Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

1 year ago

CVE

Open in Source