BIT-grafana-2021-28147

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2021-28147.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-grafana-2021-28147
Aliases
Published
2024-03-06T10:59:54.599Z
Modified
2024-03-06T11:25:28.861Z
Summary
[none]
Details

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.

Database specific
{
    "cpes": [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / grafana

Package

Name
grafana
Purl
pkg:bitnami/grafana

Severity

  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
6.0.0
Fixed
6.7.6
Introduced
7.0.0
Fixed
7.3.10
Introduced
7.4.0
Fixed
7.4.5