Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin
Résumé
Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory github.com
- advisory lists.fedoraproject.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com