Loading vulnerability…
Grafana Cross-Organization Permission Authorization Flaw
CVE-2023-4822 is an incorrect authorization vulnerability in multi-organization Grafana instances. A user holding Organization Admin privileges in one organization can modify the permissions assigned to Organization Viewer, Organization Editor, and Organization Admin roles across all organizations. The user can also globally assign or revoke permissions that they hold for any user. This enables an Organization Admin to elevate their own permissions in organizations of which they are already a member, or to elevate or restrict other users' permissions. The flaw does not permit adding oneself or others to organizations where they are not already members.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An Organization Admin can compromise the integrity of Grafana authorization policy across organizational boundaries. They can alter the permissions of built-in organization roles globally, elevate their own rights within organizations in which they already have membership, and elevate or restrict permissions held by other users globally. The vulnerability does not enable membership creation in organizations to which the attacker does not already belong.
If you can’t patch tonight, do this now.
Until updates are installed, minimize assignment of Grafana Organization Admin privileges, especially in multi-organization deployments. Review organization memberships and role permissions, monitor for unexpected changes to role definitions or user permissions, and promptly revoke unnecessary Organization Admin access.
Patch, then assume compromise.
For affected Red Hat Ceph Storage 7.1 deployments, install the updated Ceph packages supplied by RHSA-2024:3925. The advisory updates Ceph to version 18.2.1-194 for supported Red Hat Enterprise Linux 8 and 9 configurations and addresses CVE-2023-4822.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.