Improper Privilege Management

🗓️ 19 Oct 2023 08:06:21Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 29 Views

Github.com/grafana/grafana is vulnerable to Improper Privilege Management. The vulnerability impacts Grafana instances with several organizations, which allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations

Reporter	Title	Published	Views	Family All 35
AlpineLinux	CVE-2023-4822	16 Oct 202309:15	–	alpinelinux
BDU FSTEC	The vulnerability of the Grafana monitoring and observation platform lies in its permission list for authorized access, which allows a violator to increase their privileges.	4 Apr 202400:00	–	bdu_fstec
Circl	CVE-2023-4822	14 Feb 202509:46	–	circl
CNNVD	Grafana Security Vulnerabilities	16 Oct 202300:00	–	cnnvd
CVE	CVE-2023-4822	16 Oct 202308:45	–	cve
Cvelist	CVE-2023-4822	16 Oct 202308:45	–	cvelist
EUVD	EUVD-2023-2733	3 Oct 202520:07	–	euvd
Github Security Blog	Grafana privilege escalation vulnerability	16 Oct 202309:30	–	github
Grafana	Grafana org admins can modify permissions across all orgs	12 Oct 202300:00	–	grafana
Tenable Nessus	Grafana Labs Security Bypass (CVE-2023-4822)	1 Nov 202300:00	–	nessus

Vulners

Node

grafana github.com/grafana/grafanaRangev8.0.0-beta1–8.0.0-beta1go

grafana github.com/grafana/grafanaRangev9.5.0–9.5.0go

grafana github.com/grafana/grafanaRangev10.0.0-preview–v10.0.8go

grafana github.com/grafana/grafanaRangev10.1.0–v10.1.4go

Source	Link
grafana	www.grafana.com/blog/2023/10/13/grafana-security-release-new-versions-of-grafana-with-a-medium-severity-security-fix-for-cve-2023-4822/
github	www.github.com/advisories/GHSA-fw9c-75hh-89p6
grafana	www.grafana.com/security/security-advisories/cve-2023-4822
security	www.security.netapp.com/advisory/ntap-20231103-0008/

13 Feb 2025 19:29Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.16.7 - 7.2

EPSS0.01074

SSVC