An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing…
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Grafana Labs
- Product
- Grafana Enterprise, Grafana OSS
- CVSS v4.0
- 8.9 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-285
- Exposure class
- Network management
- NVD status
- Received
Why it ranks 17 (Routine)
- CVSS v4.0 8.9 high
- Product class: network management
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.