Описание
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
A flaw was found in Grafana OSS. An authorization bypass vulnerability in the provisioning contact points API allows users with an Editor role to modify protected webhook URLs. This can lead to unauthorized changes to notification configurations, potentially resulting in information disclosure or integrity issues.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | grafana | Not affected | ||
| Red Hat Enterprise Linux 8 | grafana | Not affected | ||
| Red Hat Enterprise Linux 9 | grafana | Not affected |
Показывать по
Дополнительная информация
Статус:
5.4 Medium
CVSS3
Связанные уязвимости
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
A vulnerability has been discovered in Grafana OSS where an authorizat ...
Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions
Уязвимость платформы для мониторинга и наблюдения Grafana, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
5.4 Medium
CVSS3