Skip to content
OpenAdvisories
Medium · 4.1 CVE-2023-2183 BIT-grafana-2023-2183EUVD-2023-1778GHSA-cvm3-pp2j-chr3

Grafana has Broken Access Control in Alert manager: Viewer can send test alerts

Published Jun 6, 2023 · Updated Feb 13, 2025 · Assigned by GRAFANA

Vendor: Grafana Product: Grafana Product: Grafana Enterprise Package: github.com/grafana/grafana Package: grafana Category: Web / CMS Ecosystem: Go Ecosystem: Ubuntu

Description

Grafana is an open-source platform for monitoring and observability.

The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.

This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.

Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

Affected products

VendorProductAffectedFixed
Grafana Grafana 8.0.0 – < 8.5.26, 9.0.0 – < 9.2.19, 9.3.0 – < 9.3.15, 9.4.0 – < 9.4.12, 9.5.0 – < 9.5.3 8.5.26
Grafana Grafana Enterprise 8.0.0 – < 8.5.26, 9.0.0 – < 9.2.19, 9.3.0 – < 9.3.15, 9.4.0 – < 9.4.12, 9.5.0 – < 9.5.3 8.5.26

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Ceph Storage 6 ceph +26 2:17.2.6-167.el9cp RHSA-2023:7740
Red Hat Ceph Storage 6 cephadm-ansible 1:2.18.0-1.el9cp RHSA-2023:7740

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 grafana 9.5.5-150200.3.44.1 SUSE-SU-2023:2917-1
SLES 15 SP4 grafana 9.5.5-150200.3.44.1 SUSE-SU-2023:2917-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Manager Client Tools Beta for SLE Micro 5 dracut-saltboot 0.1.1681904360.84ef141-159000.3.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 uyuni-proxy-systemd-services 5.0.1-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 ansible 2.9.27-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 dracut-saltboot 0.1.1681904360.84ef141-159000.3.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-boynux-squid_exporter 1.6-159000.4.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-lusitaniae-apache_exporter 1.0.0-159000.4.12.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-prometheus-prometheus 2.45.0-159000.6.33.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 grafana 9.5.5-150000.1.51.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:2915-1
SUSE Manager Client Tools 15 mgr-push 5.0.1-159000.4.21.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 prometheus-postgres_exporter 0.10.1-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-hwdata 2.3.5-159000.5.13.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-pyvmomi 6.7.3-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 rhnlib 5.0.1-159000.6.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 spacecmd 5.0.1-159000.6.42.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 spacewalk-client-tools 5.0.1-159000.6.48.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 supportutils-plugin-salt 1.2.2-159000.5.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 supportutils-plugin-susemanager-client 5.0.1-159000.6.15.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 uyuni-common-libs 5.0.1-159000.3.33.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 uyuni-proxy-systemd-services 5.0.1-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 12 golang-github-QubitProducts-exporter_exporter 0.4.0-4.6.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-boynux-squid_exporter 1.6-4.9.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-lusitaniae-apache_exporter 1.0.0-4.12.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-alertmanager 0.26.0-4.12.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-node_exporter 1.5.0-4.15.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-prometheus 2.45.0-4.33.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-promu 0.14.0-4.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 grafana 9.5.5-1.51.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:2916-1
SUSE Manager Client Tools 12 kiwi-desc-saltboot 0.1.1687520761.cefb248-4.15.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 mgr-push 5.0.1-4.21.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 prometheus-blackbox_exporter 0.24.0-3.6.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 prometheus-postgres_exporter 0.10.1-3.6.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 python-hwdata 2.3.5-15.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 rhnlib 5.0.1-24.30.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 spacecmd 5.0.1-41.42.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 supportutils-plugin-salt 1.2.2-9.9.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client 5.0.1-9.15.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 system-user-grafana +1 1.0.0-3.7.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 uyuni-common-libs 5.0.1-3.33.3 SUSE-SU-2024:0191-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 10.0.1-2.1 openSUSE-SU-2024:13027-1
openSUSE Leap 15.5 grafana 9.5.5-150200.3.44.1 SUSE-SU-2023:2917-1
openSUSE Leap 15.4 grafana 9.5.5-150200.3.44.1 SUSE-SU-2023:2917-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/grafana/grafana < 8.5.26 8.5.26 GHSA-cvm3-pp2j-chr3
Go github.com/grafana/grafana >= 9.0.0, < 9.2.19 9.2.19 GHSA-cvm3-pp2j-chr3
Go github.com/grafana/grafana >= 9.3.0, < 9.3.15 9.3.15 GHSA-cvm3-pp2j-chr3
Go github.com/grafana/grafana >= 9.4.0, < 9.4.12 9.4.12 GHSA-cvm3-pp2j-chr3
Go github.com/grafana/grafana >= 9.5.0, < 9.5.3 9.5.3 GHSA-cvm3-pp2j-chr3

Advisories 8

References