Privilege Escalation

2022-11-1104:12:28

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

privilege escalation

email validation

admins

user registration

software security

0.002 Low

EPSS

Percentile

53.0%

JSON

github.com/grafana/grafana is vulnerable to privilege escalation due to improper email validation in the response parameter of org_invite.go. Admins can create new users with a registration link sent via email, allowing an attacker to register a user on the site with a different email address used than the one used for sending the registration link.

CPENameOperatorVersion
github.com/grafana/grafanalev9.2.3
github.com/grafana/grafanalev8.5.13
github.com/grafana/grafanalev0.0.1-test
grafanaeq6.2.2__2.el8
grafanaeq7.5.7__2.el8
grafanaeq7.5.9__4.el8
grafanaeq7.3.6__1.el8
grafanaeq6.3.6__2.el8_2
grafanaeq7.3.4__1.el8
grafanaeq6.3.6__1.el8

Name	Operator	Version
github.com/grafana/grafana	le	v9.2.3
github.com/grafana/grafana	le	v8.5.13
github.com/grafana/grafana	le	v0.0.1-test
grafana	eq	6.2.2__2.el8
grafana	eq	7.5.7__2.el8
grafana	eq	7.5.9__4.el8
grafana	eq	7.3.6__1.el8
grafana	eq	6.3.6__2.el8_2
grafana	eq	7.3.4__1.el8
grafana	eq	6.3.6__1.el8

Rows per page:

1-10 of 541

References

github.com/grafana/grafana/commit/be4228db5a43f65a989239f891185d45912d39ad

github.com/grafana/grafana/commit/f8239a2157bf63a18c4429c25aa7b934b09c3be9

github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84

grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306

security.netapp.com/advisory/ntap-20221215-0004/