PT-2021-23209 · Grafana+2 · Grafana+2
Richih
·
Published
2021-11-15
·
Updated
2024-06-15
·
CVE-2021-41244
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Grafana versions 8.0 through 8.2.3
Description
Grafana is an open-source platform for monitoring and observability. In affected versions, when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, admins are able to access users from other organizations. Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin. With fine-grained access control enabled, organization admins can list, add, remove and update users' roles in another organization, where they do not have organization admin role.
Recommendations
For versions 8.0 through 8.2.3, upgrade to version 8.2.4 as soon as possible.
If you cannot upgrade, turn off the fine-grained access control using a feature flag.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Grafana
Suse