Improper Authorization in Grafana - CVE-2024-1313

Vulnerability identifier: #VU87845

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-1313

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authorization.

The vulnerability exists due to improper authorization checks. A remote user outside an organization can send a DELETE request to /api/snapshots/ using its view key to bypass authorization and delete a snapshot.

Grafana
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Proxy
SUSE Manager Proxy Module
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Manager Client Tools Beta for SLE Micro
SUSE Manager Client Tools for SLE Micro
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Manager Client Tools Beta for SLE
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Package Hub 15
openSUSE Leap
Storage Ceph
mgrctl
mgrctl-zsh-completion
mgrctl-lang
mgrctl-bash-completion
POS_Image-Graphical7
POS_Image-JeOS7
dracut-saltboot
golang-github-prometheus-promu
golang-github-prometheus-alertmanager
golang-github-prometheus-node_exporter
ansible
ansible-test
ansible-doc
mybatis-javadoc
mybatis
spacewalk-koan
python2-spacewalk-koan
python3-spacewalk-koan
mgr-daemon
python2-uyuni-common-libs
python3-uyuni-common-libs
uyuni-proxy-systemd-services
python2-spacewalk-client-tools
spacewalk-client-tools
python2-spacewalk-check
spacewalk-check
python2-spacewalk-client-setup
spacewalk-client-setup
python3-spacewalk-client-tools
python3-spacewalk-check
python3-spacewalk-client-setup
spacecmd
mgr-push
python2-mgr-push
python3-mgr-push
grafana (Red Hat package)
grafana
grafana-selinux
grafana-debuginfo
OpenShift Service Mesh

Install updates from vendor's website.

Grafana - addressed in versions 9.5.18, 10.0.13, 10.1.9, 10.2.6, 10.3.5
Storage Ceph - update to 7.1z3
mgrctl - addressed in versions 0.1.9-3.11.4, 0.1.9-159000.3.11.5
mgrctl-zsh-completion - addressed in versions 0.1.9-3.11.4, 0.1.9-159000.3.11.5
mgrctl-lang - addressed in versions 0.1.9-3.11.4, 0.1.9-159000.3.11.5
mgrctl-bash-completion - addressed in versions 0.1.9-3.11.4, 0.1.9-159000.3.11.5
POS_Image-Graphical7 - update to 0.1.1710765237.46af599-150000.1.21.2
POS_Image-JeOS7 - update to 0.1.1710765237.46af599-150000.1.21.2
dracut-saltboot - update to 0.1.1710765237.46af599-150000.1.53.2
golang-github-prometheus-promu - addressed in versions 0.14.0-1.18.1, 0.14.0-150000.3.18.2
golang-github-prometheus-alertmanager - update to 0.26.0-1.27.2
golang-github-prometheus-node_exporter - addressed in versions 1.7.0-1.30.2, 1.7.0-159000.6.5.5
OpenShift Service Mesh - addressed in versions 2.4.8, 2.5.2
ansible - update to 2.9.27-150000.1.17.2
ansible-test - update to 2.9.27-150000.1.17.2
ansible-doc - update to 2.9.27-150000.1.17.2
mybatis-javadoc - update to 3.5.6-150200.5.6.1
mybatis - update to 3.5.6-150200.5.6.1
spacewalk-koan - addressed in versions 4.3.6-24.36.1, 4.3.6-150000.3.33.2
python2-spacewalk-koan - update to 4.3.6-24.36.1
python3-spacewalk-koan - update to 4.3.6-150000.3.33.2
mgr-daemon - addressed in versions 4.3.9-1.47.1, 4.3.9-150000.1.47.2
python2-uyuni-common-libs - addressed in versions 4.3.10-1.39.1, 5.0.3-3.39.3
python3-uyuni-common-libs - addressed in versions 4.3.10-150000.1.39.2, 5.0.3-159000.3.39.3
uyuni-proxy-systemd-services - update to 4.3.12-150000.1.21.2
python2-spacewalk-client-tools - update to 4.3.19-52.98.1
spacewalk-client-tools - addressed in versions 4.3.19-52.98.1, 4.3.19-150000.3.89.2
python2-spacewalk-check - update to 4.3.19-52.98.1
spacewalk-check - addressed in versions 4.3.19-52.98.1, 4.3.19-150000.3.89.2
python2-spacewalk-client-setup - update to 4.3.19-52.98.1
spacewalk-client-setup - addressed in versions 4.3.19-52.98.1, 4.3.19-150000.3.89.2
python3-spacewalk-client-tools - update to 4.3.19-150000.3.89.2
python3-spacewalk-check - update to 4.3.19-150000.3.89.2
python3-spacewalk-client-setup - update to 4.3.19-150000.3.89.2
spacecmd - addressed in versions 4.3.27-38.139.1, 4.3.27-150000.3.116.2, 5.0.6-41.51.3, 5.0.6-159000.6.51.4
mgr-push - addressed in versions 5.0.2-4.24.5, 5.0.2-159000.4.24.5
python2-mgr-push - update to 5.0.2-4.24.5
python3-mgr-push - update to 5.0.2-159000.4.24.5
grafana (Red Hat package) - addressed in versions 9.2.10-16.el8_10, 9.2.10-16.el9_4
grafana - update to 9.2.10-16.0.1
grafana-selinux - update to 9.2.10-16.0.1
grafana - addressed in versions 9.5.18-1.63.1, 9.5.18-4.30.4, 9.5.18-150000.1.63.2, 9.5.18-150200.3.56.1, 9.5.18-159000.4.33.4
grafana-debuginfo - addressed in versions 9.5.18-150000.1.63.2, 9.5.18-150200.3.56.1, 9.5.18-159000.4.33.4

• https://grafana.com/security/security-advisories/cve-2024-1313/

• Improper Authorization in Grafana
• Red Hat Enterprise Linux 9 update for grafana
• SUSE update for SUSE Manager Client Tools
• SUSE update for SUSE Manager Client Tools
• SUSE update for grafana and mybatis
• SUSE update for Security Beta update for SUSE Manager Client Tools and Salt
• SUSE update for Security Beta update for SUSE Manager Client Tools
• Red Hat Enterprise Linux 8 update for grafana
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• SUSE update for grafana and mybatis
• Anolis OS update for grafana
• IBM Storage Ceph update for Grafana