Описание
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission.
An authorization bypass in Grafana allows Editor-role users to delete protected contact points because a previous security patch for updating them missed the deletion process.
Отчет
This Moderate impact authorization bypass in Grafana allows an authenticated Editor-role user to delete protected contact points without the necessary permissions. This could disrupt alert notifications in Red Hat deployments where Grafana is configured with alert managers and Editor-role users have access to manage alert configurations.
Меры по смягчению последствий
To mitigate this issue grant the Editor role only to trusted users and restrict access to the Grafana UI/API to trusted networks. Audit contact-point / receiver deletions and treat protected notification endpoints as sensitive configuration.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Fix deferred | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-grafana-rhel9 | Fix deferred | ||
| Red Hat Ceph Storage 5 | rhceph/rhceph-5-dashboard-rhel8 | Fix deferred | ||
| Red Hat Ceph Storage 6 | rhceph/rhceph-6-dashboard-rhel9 | Fix deferred | ||
| Red Hat Ceph Storage 7 | rhceph/grafana-rhel9 | Fix deferred | ||
| Red Hat Ceph Storage 8 | rhceph/grafana-rhel9 | Not affected | ||
| Red Hat Ceph Storage 9 | rhceph/grafana-rhel10 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | grafana | Not affected | ||
| Red Hat Enterprise Linux 8 | grafana | Not affected | ||
| Red Hat Enterprise Linux 9 | grafana | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission.
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission.
6.5 Medium
CVSS3