Privilege escalation in Grafana
CVE-2023-4822
Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally. This means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user. The vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.
Vulnerability class: Privilege Escalation
EPSS: 0.011 (62.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L.
Affected products
- Grafana — versions 10.1.4
- Grafana Enterprise — versions 8.0.0, 9.5.0, 10.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@grafana.com (Vendor Advisory)
- security@grafana.com (Third Party Advisory)
Frequently asked questions
- What is CVE-2023-4822?
- CVE-2023-4822 is a medium-severity vulnerability in Grafana, classified under Improper Privilege Management. CVSS score: 6.7/10. Published 2023-10-16.
- How severe is CVE-2023-4822?
- Medium severity. CVSS v3 base score is 6.7 out of 10.
- Is CVE-2023-4822 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.