The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade grafana | Aug 22, 2024 | Mar 22, 2021 |
| Suse | — | Upgrade mgr-cfgUpgrade python2-mgr-osa-commonUpgrade python2-spacewalk-client-toolsUpgrade mgr-cfg-managementUpgrade spacewalk-checkUpgrade python2-mgr-cfgUpgrade mgr-osa-dispatcherUpgrade python3-spacewalk-client-toolsUpgrade python2-mgr-virtualization-hostUpgrade python2-mgr-pushUpgrade python2-mgr-cfg-managementUpgrade python3-spacewalk-koanUpgrade python3-mgr-virtualization-hostUpgrade python3-mgr-cfg-clientUpgrade python3-mgr-osa-commonUpgrade python2-mgr-cfg-actionsUpgrade golang-github-prometheus-prometheusUpgrade python3-suseregisterinfoUpgrade python2-mgr-osa-dispatcherUpgrade mgr-pushUpgrade mgr-osadUpgrade grafanaUpgrade python3-mgr-cfg-managementUpgrade mgr-cfg-clientUpgrade python2-suseregisterinfoUpgrade mgr-custom-infoUpgrade python3-mgr-osa-dispatcherUpgrade python2-rhnlibUpgrade ansible-testUpgrade python2-mgr-osadUpgrade ansible-docUpgrade python2-spacewalk-client-setupUpgrade spacewalk-oscapUpgrade python2-spacewalk-oscapUpgrade mgr-virtualization-hostUpgrade python3-mgr-osadUpgrade mgr-cfg-actionsUpgrade spacewalk-koanUpgrade spacewalk-client-setupUpgrade python3-mgr-pushUpgrade spacewalk-client-toolsUpgrade python2-spacewalk-checkUpgrade ansibleUpgrade python3-spacewalk-client-setupUpgrade python3-mgr-virtualization-commonUpgrade python2-mgr-cfg-clientUpgrade python2-mgr-virtualization-commonUpgrade python3-spacewalk-checkUpgrade python3-rhnlibUpgrade python3-mgr-cfgUpgrade python2-uyuni-common-libsUpgrade python2-spacewalk-koanUpgrade suseregisterinfoUpgrade python3-mgr-cfg-actionsUpgrade spacecmdUpgrade python3-uyuni-common-libsUpgrade python3-spacewalk-oscapUpgrade dracut-saltboot | Aug 13, 2021 | Mar 22, 2021 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub