Grafana up to 8.5.12/9.0.8/9.1.5 RBAC permissions

Summaryinfo

A vulnerability labeled as critical has been found in Grafana up to 8.5.12/9.0.8/9.1.5. This affects an unknown function of the component RBAC. Executing a manipulation can lead to permissions. This vulnerability appears as CVE-2022-36062. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Grafana up to 8.5.12/9.0.8/9.1.5. It has been declared as critical. This vulnerability affects an unknown part of the component RBAC. The manipulation with an unknown input leads to a permissions vulnerability. The CWE definition for the vulnerability is CWE-281. The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually.

The weakness was presented 09/23/2022 as GHSA-p978-56hq-r492. The advisory is available at github.com. This vulnerability was named CVE-2022-36062 since 07/15/2022. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1222 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 261276 (Linux Distros Unpatched Vulnerability : CVE-2022-36062), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 8.5.13, 9.0.9 or 9.1.6 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (261276) and EUVD (EUVD-2024-1710). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Grafana

Version

• 8.5.0
• 8.5.1
• 8.5.2
• 8.5.3
• 8.5.4
• 8.5.5
• 8.5.6
• 8.5.7
• 8.5.8
• 8.5.9
• 8.5.10
• 8.5.11
• 8.5.12
• 9.0.0
• 9.0.1
• 9.0.2
• 9.0.3
• 9.0.4
• 9.0.5
• 9.0.6
• 9.0.7
• 9.0.8
• 9.1.0
• 9.1.1
• 9.1.2
• 9.1.3
• 9.1.4
• 9.1.5

License

• open-source

Website

• Product: https://github.com/grafana/grafana/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion