The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade grafana | Aug 22, 2024 | Mar 22, 2021 |
| Suse | — | Upgrade python2-uyuni-common-libsUpgrade suseregisterinfoUpgrade python3-mgr-virtualization-commonUpgrade python3-rhnlibUpgrade python2-mgr-cfg-clientUpgrade python3-mgr-cfg-actionsUpgrade python3-spacewalk-client-setupUpgrade python3-mgr-cfgUpgrade python2-spacewalk-koanUpgrade python3-spacewalk-checkUpgrade python3-uyuni-common-libsUpgrade spacewalk-koanUpgrade ansible-docUpgrade python2-spacewalk-oscapUpgrade mgr-cfg-actionsUpgrade spacewalk-client-setupUpgrade spacecmdUpgrade python3-mgr-pushUpgrade mgr-virtualization-hostUpgrade spacewalk-oscapUpgrade python2-spacewalk-client-setupUpgrade ansibleUpgrade python2-spacewalk-checkUpgrade python2-mgr-virtualization-commonUpgrade dracut-saltbootUpgrade python3-mgr-osadUpgrade python3-spacewalk-oscapUpgrade spacewalk-client-toolsUpgrade spacewalk-checkUpgrade python2-mgr-cfg-actionsUpgrade python2-rhnlibUpgrade grafanaUpgrade python3-mgr-osa-dispatcherUpgrade mgr-osa-dispatcherUpgrade python2-mgr-pushUpgrade python3-mgr-osa-commonUpgrade python3-spacewalk-client-toolsUpgrade python2-mgr-osadUpgrade mgr-cfg-clientUpgrade ansible-testUpgrade python3-mgr-cfg-managementUpgrade golang-github-prometheus-prometheusUpgrade python2-suseregisterinfoUpgrade mgr-osadUpgrade python3-mgr-cfg-clientUpgrade python3-spacewalk-koanUpgrade python3-mgr-virtualization-hostUpgrade python2-mgr-osa-dispatcherUpgrade python2-mgr-osa-commonUpgrade python2-spacewalk-client-toolsUpgrade mgr-cfgUpgrade mgr-cfg-managementUpgrade mgr-custom-infoUpgrade python3-suseregisterinfoUpgrade mgr-pushUpgrade python2-mgr-cfgUpgrade python2-mgr-virtualization-hostUpgrade python2-mgr-cfg-management | Aug 13, 2021 | Mar 22, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub