Improper Privilege Management in Grafana - CVE-2021-27962

Vulnerability identifier: #VU51579

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-27962

CWE-ID: CWE-269

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges within the application.

The vulnerability exists due to improper privilege management. A remote user with Editor privileges can bypass data source permissions on the organization's default data source.

Grafana
SUSE Manager Tools
python3-jabberpy
python3-immutables-debuginfo
python3-immutables
python-immutables-debugsource
prometheus-blackbox_exporter
prometheus-blackbox_exporter-debuginfo
hwdata
system-user-prometheus
system-user-grafana
zypp-plugin-spacewalk
python3-zypp-plugin-spacewalk
python2-zypp-plugin-spacewalk
sysuser-shadow
python3-hwdata
python3-contextvars
koan
ansible-doc
ansible
golang-github-prometheus-prometheus
mgr-custom-info
mgr-virtualization-host
python3-mgr-virtualization-common
python3-mgr-virtualization-host
python2-mgr-virtualization-host
python2-mgr-virtualization-common
spacewalk-oscap
python3-spacewalk-oscap
python2-spacewalk-oscap
mgr-push
python3-mgr-push
python2-mgr-push
mgr-cfg
mgr-cfg-actions
mgr-cfg-client
mgr-cfg-management
python3-mgr-cfg
python3-mgr-cfg-actions
python3-mgr-cfg-client
python3-mgr-cfg-management
python2-mgr-cfg-management
python2-mgr-cfg-client
python2-mgr-cfg-actions
python2-mgr-cfg
python3-suseRegisterInfo
suseRegisterInfo
python3-spacewalk-koan
spacewalk-koan
python3-rhnlib
python2-rhnlib
python2-spacewalk-koan
python2-suseRegisterInfo
python3-uyuni-common-libs
python2-uyuni-common-libs
python3-mgr-osad
python3-mgr-osa-common
mgr-osad
python2-mgr-osad
python2-mgr-osa-common
spacecmd
spacewalk-client-setup
python3-spacewalk-check
python3-spacewalk-client-setup
python3-spacewalk-client-tools
spacewalk-client-tools
spacewalk-check
python2-spacewalk-client-setup
python2-spacewalk-check
python2-spacewalk-client-tools
spacewalk-remote-utils
supportutils-plugin-susemanager-client
mgr-daemon
grafana
salt-bash-completion
salt-fish-completion
salt-zsh-completion
salt-standalone-formulas-configuration
salt-ssh
salt-proxy
salt-minion
salt-master
salt-doc
salt-cloud
salt
python3-salt

Install updates from vendor's website.

Grafana - addressed in versions 7.3.10, 7.4.5
python3-jabberpy - update to 0.5-5.5.1
python3-immutables-debuginfo - update to 0.11-3.3.1
python3-immutables - update to 0.11-3.3.1
python-immutables-debugsource - update to 0.11-3.3.1
prometheus-blackbox_exporter - addressed in versions 0.19.0-3.3.1, 0.19.0-3.3.2
prometheus-blackbox_exporter-debuginfo - addressed in versions 0.19.0-3.3.1, 0.19.0-3.3.2
hwdata - update to 0.334-6.5.1
system-user-prometheus - update to 1.0.0-3.5.1
system-user-grafana - update to 1.0.0-3.5.1
zypp-plugin-spacewalk - addressed in versions 1.0.10-6.15.1, 1.0.10-33.15.1
python3-zypp-plugin-spacewalk - update to 1.0.10-6.15.1
python2-zypp-plugin-spacewalk - update to 1.0.10-33.15.1
sysuser-shadow - update to 2.0-4.5.1
python3-hwdata - update to 2.3.5-5.7.1
python3-contextvars - update to 2.4-3.3.1
koan - addressed in versions 2.6.6-52.9.1, 3.0.1-7.12.1
ansible-doc - update to 2.9.21-1.5.1
ansible - update to 2.9.21-1.5.1
golang-github-prometheus-prometheus - addressed in versions 2.27.1-1.29.2, 2.27.1-3.31.1, 2.27.1-4.21.1, 2.27.1-6.21.2
mgr-custom-info - addressed in versions 4.2.2-1.12.1, 4.2.2-1.12.2, 4.3.2-4.9.1
mgr-virtualization-host - addressed in versions 4.2.2-1.20.1, 4.2.2-1.20.2, 4.3.1-4.9.2, 4.3.1-4.9.3
python3-mgr-virtualization-common - addressed in versions 4.2.2-1.20.1, 4.3.1-4.9.3
python3-mgr-virtualization-host - addressed in versions 4.2.2-1.20.1, 4.3.1-4.9.3
python2-mgr-virtualization-host - addressed in versions 4.2.2-1.20.2, 4.3.1-4.9.2
python2-mgr-virtualization-common - addressed in versions 4.2.2-1.20.2, 4.3.1-4.9.2
spacewalk-oscap - addressed in versions 4.2.2-3.12.1, 4.2.2-19.18.2, 4.3.1-6.9.2, 4.3.1-22.9.1
python3-spacewalk-oscap - addressed in versions 4.2.2-3.12.1, 4.3.1-6.9.2
python2-spacewalk-oscap - addressed in versions 4.2.2-19.18.2, 4.3.1-22.9.1
mgr-push - addressed in versions 4.2.3-1.12.1, 4.2.3-1.12.2, 4.3.1-4.9.1, 4.3.1-4.9.3
python3-mgr-push - addressed in versions 4.2.3-1.12.1, 4.3.1-4.9.3
python2-mgr-push - addressed in versions 4.2.3-1.12.2, 4.3.1-4.9.1
mgr-cfg - addressed in versions 4.2.3-1.18.1, 4.2.3-1.18.2, 4.3.2-4.15.1
mgr-cfg-actions - addressed in versions 4.2.3-1.18.1, 4.2.3-1.18.2, 4.3.2-4.15.1
mgr-cfg-client - addressed in versions 4.2.3-1.18.1, 4.2.3-1.18.2, 4.3.2-4.15.1
mgr-cfg-management - addressed in versions 4.2.3-1.18.1, 4.2.3-1.18.2, 4.3.2-4.15.1
python3-mgr-cfg - addressed in versions 4.2.3-1.18.1, 4.3.2-4.15.1
python3-mgr-cfg-actions - addressed in versions 4.2.3-1.18.1, 4.3.2-4.15.1
python3-mgr-cfg-client - addressed in versions 4.2.3-1.18.1, 4.3.2-4.15.1
python3-mgr-cfg-management - addressed in versions 4.2.3-1.18.1, 4.3.2-4.15.1
python2-mgr-cfg-management - addressed in versions 4.2.3-1.18.2, 4.3.2-4.15.1
python2-mgr-cfg-client - addressed in versions 4.2.3-1.18.2, 4.3.2-4.15.1
python2-mgr-cfg-actions - addressed in versions 4.2.3-1.18.2, 4.3.2-4.15.1
python2-mgr-cfg - addressed in versions 4.2.3-1.18.2, 4.3.2-4.15.1
python3-suseRegisterInfo - addressed in versions 4.2.4-3.15.1, 4.3.1-6.15.2
suseRegisterInfo - addressed in versions 4.2.4-3.15.1, 4.2.4-25.18.2, 4.3.1-6.15.2, 4.3.1-28.15.1
python3-spacewalk-koan - addressed in versions 4.2.4-3.21.1, 4.3.1-6.9.2
spacewalk-koan - addressed in versions 4.2.4-3.21.1, 4.2.4-24.24.2, 4.3.1-6.9.2, 4.3.1-27.9.1
python3-rhnlib - addressed in versions 4.2.4-3.28.1, 4.3.1-6.18.2
python2-rhnlib - addressed in versions 4.2.4-21.34.2, 4.3.1-24.18.1
python2-spacewalk-koan - addressed in versions 4.2.4-24.24.2, 4.3.1-27.9.1
python2-suseRegisterInfo - addressed in versions 4.2.4-25.18.2, 4.3.1-28.15.1
python3-uyuni-common-libs - addressed in versions 4.2.5-1.15.1, 4.3.1-3.21.2
python2-uyuni-common-libs - addressed in versions 4.2.5-1.15.2, 4.3.1-3.21.1
python3-mgr-osad - addressed in versions 4.2.6-1.30.1, 4.3.2-4.18.2
python3-mgr-osa-common - addressed in versions 4.2.6-1.30.1, 4.3.2-4.18.2
mgr-osad - addressed in versions 4.2.6-1.30.1, 4.2.6-1.30.2, 4.3.2-4.18.2
python2-mgr-osad - addressed in versions 4.2.6-1.30.2, 4.3.2-4.18.2
python2-mgr-osa-common - addressed in versions 4.2.6-1.30.2, 4.3.2-4.18.2
spacecmd - addressed in versions 4.2.11-3.62.1, 4.2.11-38.85.2, 4.3.4-6.27.1, 4.3.4-41.27.1
spacewalk-client-setup - addressed in versions 4.2.12-3.44.1, 4.2.12-52.53.2, 4.3.4-6.33.3, 4.3.4-55.33.1
python3-spacewalk-check - addressed in versions 4.2.12-3.44.1, 4.3.4-6.33.3
python3-spacewalk-client-setup - addressed in versions 4.2.12-3.44.1, 4.3.4-6.33.3
python3-spacewalk-client-tools - addressed in versions 4.2.12-3.44.1, 4.3.4-6.33.3
spacewalk-client-tools - addressed in versions 4.2.12-3.44.1, 4.2.12-52.53.2, 4.3.4-6.33.3, 4.3.4-55.33.1
spacewalk-check - addressed in versions 4.2.12-3.44.1, 4.2.12-52.53.2, 4.3.4-6.33.3, 4.3.4-55.33.1
python2-spacewalk-client-setup - addressed in versions 4.2.12-52.53.2, 4.3.4-55.33.1
python2-spacewalk-check - addressed in versions 4.2.12-52.53.2, 4.3.4-55.33.1
python2-spacewalk-client-tools - addressed in versions 4.2.12-52.53.2, 4.3.4-55.33.1
spacewalk-remote-utils - addressed in versions 4.3.1-6.9.2, 4.3.1-27.9.1
supportutils-plugin-susemanager-client - addressed in versions 4.3.1-6.12.2, 4.3.1-9.12.1
mgr-daemon - addressed in versions 4.3.2-4.15.1, 4.3.2-4.15.2
grafana - addressed in versions 7.5.7-1.21.1, 7.5.7-1.21.2, 7.5.7-4.15.1, 7.5.7-4.15.3
salt-bash-completion - update to 3003.3-8.44.1
salt-fish-completion - update to 3003.3-8.44.1
salt-zsh-completion - update to 3003.3-8.44.1
salt-standalone-formulas-configuration - update to 3003.3-8.44.1
salt-ssh - update to 3003.3-8.44.1
salt-proxy - update to 3003.3-8.44.1
salt-minion - update to 3003.3-8.44.1
salt-master - update to 3003.3-8.44.1
salt-doc - update to 3003.3-8.44.1
salt-cloud - update to 3003.3-8.44.1
salt - update to 3003.3-8.44.1
python3-salt - update to 3003.3-8.44.1

• https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/

• Multiple vulnerabilities in Grafana
• SUSE update for grafana
• SUSE update for SUSE Manager Client Tools
• SUSE update for SUSE Manager Client Tools
• SUSE update for Security Beta update for SUSE Manager Client Tools
• SUSE update for Security Beta update for SUMA client tools