grafana: incorrect assessment of permissions across organizations
Published Oct 16, 2023
7.2
HIGHCVSS 3.1
EPSS 1.07%
Description
Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations.
It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally.
This means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user.
The vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.
Affected products
-
- Version 10.0.0StatusaffectedConstraints<10.0.7
- Version 10.1.0StatusaffectedConstraints<10.1.3
- Version 8.0.0StatusaffectedConstraints<9.4.16
- Version 9.5.0StatusaffectedConstraints<9.5.11
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Grafana | Grafana Enterprise | unaffected |
|
-
- Version 10.0.0StatusaffectedConstraints<10.0.7
- Version 10.1.0StatusaffectedConstraints<10.1.3
- Version 8.0.0StatusaffectedConstraints<9.4.16
- Version 9.5.0StatusaffectedConstraints<9.5.11
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Grafana | Grafana Enterprise | n/a |
|
Red Hat Ceph Storage 7.1
ceph-2:18.2.1-194.el8cp
Fixed · RHSA-2024:3925
Red Hat Ceph Storage 7.1
cephadm-ansible-1:3.2.0-1.el9cp
Fixed · RHSA-2024:3925
Red Hat Ceph Storage 7.1
gperftools-1:2.7-9.el8cp
Fixed · RHSA-2024:3925
Red Hat Ceph Storage 7.1
libunwind-0:1.3.1-3.el8cp
Fixed · RHSA-2024:3925
Red Hat Ceph Storage 7.1
oath-toolkit-0:2.6.2-3.el8cp
Fixed · RHSA-2024:3925
Red Hat Ceph Storage 7.1
thrift-0:0.13.0-2.el8cp
Fixed · RHSA-2024:3925
Cryostat 2
cryostat-tech-preview/cryostat-grafana-dashboard-rhel8
Not affected
OpenShift Service Mesh 2
openshift-service-mesh/grafana-rhel8
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/acm-grafana-rhel8
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/grafana-dashboard-loader-rhel8
Not affected
Red Hat Ceph Storage 4
rhceph/rhceph-4-dashboard-rhel8
Not affected
Red Hat Ceph Storage 5
rhceph/rhceph-5-dashboard-rhel8
Not affected
Red Hat Ceph Storage 6
rhceph/rhceph-6-dashboard-rhel9
Not affected
Red Hat Enterprise Linux 8
grafana
Not affected
Red Hat Enterprise Linux 9
grafana
Not affected
Red Hat OpenShift Container Platform 3.11
openshift3/grafana
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-grafana
Not affected
Red Hat Storage 3
grafana
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 7.1 | ceph-2:18.2.1-194.el8cp | Fixed | RHSA-2024:3925 |
| Red Hat Ceph Storage 7.1 | cephadm-ansible-1:3.2.0-1.el9cp | Fixed | RHSA-2024:3925 |
| Red Hat Ceph Storage 7.1 | gperftools-1:2.7-9.el8cp | Fixed | RHSA-2024:3925 |
| Red Hat Ceph Storage 7.1 | libunwind-0:1.3.1-3.el8cp | Fixed | RHSA-2024:3925 |
| Red Hat Ceph Storage 7.1 | oath-toolkit-0:2.6.2-3.el8cp | Fixed | RHSA-2024:3925 |
| Red Hat Ceph Storage 7.1 | thrift-0:0.13.0-2.el8cp | Fixed | RHSA-2024:3925 |
| Cryostat 2 | cryostat-tech-preview/cryostat-grafana-dashboard-rhel8 | Not affected | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/grafana-rhel8 | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-grafana-rhel8 | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/grafana-dashboard-loader-rhel8 | Not affected | n/a |
| Red Hat Ceph Storage 4 | rhceph/rhceph-4-dashboard-rhel8 | Not affected | n/a |
| Red Hat Ceph Storage 5 | rhceph/rhceph-5-dashboard-rhel8 | Not affected | n/a |
| Red Hat Ceph Storage 6 | rhceph/rhceph-6-dashboard-rhel9 | Not affected | n/a |
| Red Hat Enterprise Linux 8 | grafana | Not affected | n/a |
| Red Hat Enterprise Linux 9 | grafana | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift3/grafana | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-grafana | Not affected | n/a |
| Red Hat Storage 3 | grafana | Not affected | n/a |
github.com/grafana/grafana
Go
Introduced 0 Fixed not fixed
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/grafana/grafana | 0 | not fixed |
Remediation
Red Hat statement
Only Grafana enterprise instances with more than one organization are vulnerable to this security issue. Red Hat does not ship enterprise versions of Grafana, therefore, Red Hat products are not affected by this vulnerability.
References (9)
- https://access.redhat.com/security/cve/CVE-2023-4822 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2239726 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2733 Advisory
- https://github.com/advisories/GHSA-fw9c-75hh-89p6 Advisory
- https://grafana.com/blog/2023/10/13/grafana-security-release-new-versions-of-grafana-with-a-medium-severity-security-fix-for-cve-2023-4822/
- https://grafana.com/security/security-advisories/cve-2023-4822 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-4822
- https://security.netapp.com/advisory/ntap-20231103-0008 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-4822
Change history (0)
No recorded changes yet.