The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team permissions that the user isn't supposed to have.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade grafana | Aug 22, 2024 | Mar 22, 2021 |
| Suse | — | Upgrade python2-spacewalk-oscapUpgrade python2-uyuni-common-libsUpgrade python3-uyuni-common-libsUpgrade spacewalk-checkUpgrade mgr-cfg-actionsUpgrade python2-mgr-pushUpgrade mgr-custom-infoUpgrade python2-mgr-osa-commonUpgrade spacewalk-client-toolsUpgrade python3-mgr-osa-commonUpgrade mgr-cfg-clientUpgrade python3-mgr-cfg-managementUpgrade suseregisterinfoUpgrade python3-spacewalk-client-setupUpgrade spacecmdUpgrade python3-mgr-cfg-clientUpgrade python3-spacewalk-client-toolsUpgrade python3-mgr-virtualization-hostUpgrade python3-mgr-osadUpgrade python2-spacewalk-checkUpgrade grafanaUpgrade python2-spacewalk-client-toolsUpgrade mgr-virtualization-hostUpgrade python2-spacewalk-client-setupUpgrade dracut-saltbootUpgrade python2-mgr-cfg-clientUpgrade python2-mgr-virtualization-commonUpgrade python2-mgr-cfg-actionsUpgrade spacewalk-client-setupUpgrade mgr-cfgUpgrade mgr-osa-dispatcherUpgrade ansible-testUpgrade python3-mgr-cfgUpgrade python2-spacewalk-koanUpgrade python2-mgr-cfg-managementUpgrade python3-rhnlibUpgrade python3-spacewalk-koanUpgrade python3-spacewalk-checkUpgrade python2-mgr-osadUpgrade python3-suseregisterinfoUpgrade python2-mgr-cfgUpgrade python2-suseregisterinfoUpgrade python3-mgr-virtualization-commonUpgrade python3-mgr-cfg-actionsUpgrade mgr-pushUpgrade mgr-cfg-managementUpgrade python2-mgr-virtualization-hostUpgrade ansibleUpgrade spacewalk-koanUpgrade python3-spacewalk-oscapUpgrade golang-github-prometheus-prometheusUpgrade python2-rhnlibUpgrade mgr-osadUpgrade spacewalk-oscapUpgrade python3-mgr-pushUpgrade python3-mgr-osa-dispatcherUpgrade ansible-docUpgrade python2-mgr-osa-dispatcher | Aug 13, 2021 | Mar 22, 2021 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub