The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team permissions that the user isn't supposed to have.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade grafana | Aug 22, 2024 | Mar 22, 2021 |
| Suse | — | Upgrade mgr-custom-infoUpgrade python2-spacewalk-oscapUpgrade python2-uyuni-common-libsUpgrade ansible-testUpgrade mgr-cfgUpgrade python3-spacewalk-client-setupUpgrade python2-spacewalk-client-setupUpgrade python3-uyuni-common-libsUpgrade mgr-cfg-actionsUpgrade spacewalk-checkUpgrade python2-spacewalk-checkUpgrade python3-mgr-osa-commonUpgrade python2-mgr-virtualization-commonUpgrade python2-mgr-cfg-clientUpgrade spacecmdUpgrade python3-spacewalk-client-toolsUpgrade python2-mgr-cfg-actionsUpgrade mgr-osa-dispatcherUpgrade python3-mgr-osadUpgrade python3-mgr-virtualization-hostUpgrade dracut-saltbootUpgrade python2-mgr-pushUpgrade grafanaUpgrade python2-spacewalk-koanUpgrade python2-spacewalk-client-toolsUpgrade mgr-virtualization-hostUpgrade python2-mgr-osa-commonUpgrade spacewalk-client-toolsUpgrade suseregisterinfoUpgrade mgr-cfg-clientUpgrade python3-mgr-cfgUpgrade python3-mgr-cfg-clientUpgrade spacewalk-client-setupUpgrade python3-mgr-cfg-managementUpgrade python3-mgr-cfg-actionsUpgrade spacewalk-oscapUpgrade ansible-docUpgrade mgr-pushUpgrade mgr-cfg-managementUpgrade python3-mgr-pushUpgrade python3-suseregisterinfoUpgrade python2-suseregisterinfoUpgrade python2-mgr-virtualization-hostUpgrade mgr-osadUpgrade python2-mgr-osa-dispatcherUpgrade python3-mgr-virtualization-commonUpgrade golang-github-prometheus-prometheusUpgrade python3-rhnlibUpgrade python3-spacewalk-oscapUpgrade spacewalk-koanUpgrade python2-rhnlibUpgrade python3-mgr-osa-dispatcherUpgrade python2-mgr-osadUpgrade python3-spacewalk-checkUpgrade python3-spacewalk-koanUpgrade ansibleUpgrade python2-mgr-cfgUpgrade python2-mgr-cfg-management | Aug 13, 2021 | Mar 22, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub