The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-grafana | Aug 22, 2024 | Mar 22, 2021 | |
| Suse | — | suse-upgrade-ansiblesuse-upgrade-ansible-docsuse-upgrade-ansible-testsuse-upgrade-dracut-saltbootsuse-upgrade-golang-github-prometheus-prometheussuse-upgrade-grafanasuse-upgrade-mgr-cfgsuse-upgrade-mgr-cfg-actionssuse-upgrade-mgr-cfg-clientsuse-upgrade-mgr-cfg-managementsuse-upgrade-mgr-custom-infosuse-upgrade-mgr-osa-dispatchersuse-upgrade-mgr-osadsuse-upgrade-mgr-pushsuse-upgrade-mgr-virtualization-hostsuse-upgrade-python2-mgr-cfgsuse-upgrade-python2-mgr-cfg-actionssuse-upgrade-python2-mgr-cfg-clientsuse-upgrade-python2-mgr-cfg-managementsuse-upgrade-python2-mgr-osa-commonsuse-upgrade-python2-mgr-osa-dispatchersuse-upgrade-python2-mgr-osadsuse-upgrade-python2-mgr-pushsuse-upgrade-python2-mgr-virtualization-commonsuse-upgrade-python2-mgr-virtualization-hostsuse-upgrade-python2-rhnlibsuse-upgrade-python2-spacewalk-checksuse-upgrade-python2-spacewalk-client-setupsuse-upgrade-python2-spacewalk-client-toolssuse-upgrade-python2-spacewalk-koansuse-upgrade-python2-spacewalk-oscapsuse-upgrade-python2-suseregisterinfosuse-upgrade-python2-uyuni-common-libssuse-upgrade-python3-mgr-cfgsuse-upgrade-python3-mgr-cfg-actionssuse-upgrade-python3-mgr-cfg-clientsuse-upgrade-python3-mgr-cfg-managementsuse-upgrade-python3-mgr-osa-commonsuse-upgrade-python3-mgr-osa-dispatchersuse-upgrade-python3-mgr-osadsuse-upgrade-python3-mgr-pushsuse-upgrade-python3-mgr-virtualization-commonsuse-upgrade-python3-mgr-virtualization-hostsuse-upgrade-python3-rhnlibsuse-upgrade-python3-spacewalk-checksuse-upgrade-python3-spacewalk-client-setupsuse-upgrade-python3-spacewalk-client-toolssuse-upgrade-python3-spacewalk-koansuse-upgrade-python3-spacewalk-oscapsuse-upgrade-python3-suseregisterinfosuse-upgrade-python3-uyuni-common-libssuse-upgrade-spacecmdsuse-upgrade-spacewalk-checksuse-upgrade-spacewalk-client-setupsuse-upgrade-spacewalk-client-toolssuse-upgrade-spacewalk-koansuse-upgrade-spacewalk-oscapsuse-upgrade-suseregisterinfo | Aug 13, 2021 | Mar 22, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub