CVE-2023-2183
Description
Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.
How to fix
- grafana grafana8.5.26, 9.2.19, 9.3.15, 9.4.12, 9.5.3 or later
- github.com/grafana/grafana8.5.26, 9.2.19, 9.3.15, 9.4.12, 9.5.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grafana grafana | 8.0.0 ≤ v < 8.5.26, 9.0.0 ≤ v < 9.2.19, 9.3.0 ≤ v < 9.3.15, 9.4.0 ≤ v < 9.4.12, 9.5.0 ≤ v < 9.5.3 | 8.5.26, 9.2.19, 9.3.15, 9.4.12, 9.5.3 |
| github.com/grafana/grafanaGo | v < 8.5.26, 9.0.0 ≤ v < 9.2.19, 9.3.0 ≤ v < 9.3.15, 9.4.0 ≤ v < 9.4.12, 9.5.0 ≤ v < 9.5.3 | 8.5.26, 9.2.19, 9.3.15, 9.4.12, 9.5.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.