Описание
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
An authorization error has been discovered in Grafana dashboards. The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Affected | ||
| Red Hat Ceph Storage 5 | rhceph/grafana-rhel9 | Affected | ||
| Red Hat Ceph Storage 5 | rhel8/grafana | Affected | ||
| Red Hat Ceph Storage 5 | rhel9/grafana | Affected | ||
| Red Hat Ceph Storage 6 | rhceph/grafana-rhel9 | Affected | ||
| Red Hat Ceph Storage 6 | rhel8/grafana | Affected | ||
| Red Hat Ceph Storage 6 | rhel9/grafana | Affected | ||
| Red Hat Ceph Storage 8 | rhel8/grafana | Affected | ||
| Red Hat Ceph Storage 8 | rhel9/grafana | Affected | ||
| Red Hat Enterprise Linux 8 | grafana | Not affected |
Показывать по
Дополнительная информация
Статус:
8.1 High
CVSS3
Связанные уязвимости
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
The dashboard permissions API does not verify the target dashboard sco ...
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
Уязвимость прикладного программного интерфейса платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю повысить свои привилегии и получить несанкционированный доступ к защищаемой информации
8.1 High
CVSS3