The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.
This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.
Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Grafana | Grafana | affected |
|
||||||||||||||||||
| Grafana | Grafana Enterprise | affected |
|
Configuration 1 [-]
|
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Ceph Storage 6.1 | |||
| ceph-2:17.2.6-167.el9cp | cpe:/a:redhat:ceph_storage:6.1::el9 | RHSA-2023:7740 | 2023-12-12T00:00:00Z |
| cephadm-ansible-1:2.18.0-1.el9cp | cpe:/a:redhat:ceph_storage:6.1::el9 | RHSA-2023:7740 | 2023-12-12T00:00:00Z |
| rhceph/rhceph-6-dashboard-rhel9:6-82 | cpe:/a:redhat:ceph_storage:6.1::el9 | RHSA-2023:7741 | 2023-12-12T00:00:00Z |
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-1778 | Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix. |
 Github GHSA |
GHSA-cvm3-pp2j-chr3 | Grafana has Broken Access Control in Alert manager: Viewer can send test alerts |
Thu, 13 Feb 2025 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix. | Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix. |
Tue, 07 Jan 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GRAFANA
Published:
Updated: 2025-02-13T16:40:15.277Z
Reserved: 2023-04-19T12:11:08.488Z
Link: CVE-2023-2183
Vulnrichment
Updated: 2024-08-02T06:12:20.655Z
NVD
Status : Modified
Published: 2023-06-06T19:15:11.277
Modified: 2025-02-13T17:16:19.957
Link: CVE-2023-2183
Redhat
OpenCVE Enrichment
No data.