SB20230720115 - SUSE update for grafana 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20230720115

SB20230720115 - SUSE update for grafana

Published: July 20, 2023

Security Bulletin ID SB20230720115
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Missing Authorization (CVE-ID: CVE-2023-2183)

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to missing authorization in the alerts feature within API. A remote user can use the API to send multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.


2) Improper synchronization (CVE-ID: CVE-2023-2801)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect synchronization when processing multiple requests. A remote user can query multiple distinct data sources using mixed queries via public dashboard or API and crash Grafana instances.


3) Improper Authentication (CVE-ID: CVE-2023-3128)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in Azure AD OAuth implementation. Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. A remote attacker can modify their profile and provide the email address of  an existing Grafana user, bypass authentication process and gain unauthorized access to the application.

The vulnerability affects Grafana installations with Azure AD OAuth configured for a multi-tenant app.



Remediation

Install update from vendor's website.

References