https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:58:02 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-03205 bdu:2023-03205 https://cve.radiocsirt.org/vuln/bdu:2023-03205 https://cve.radiocsirt.org/vuln/bit-grafana-2023-2183 <p><strong>Affected:</strong> Bitnami: grafana</p> <p>Grafana is an open-source platform for monitoring and observability.</p> <p>The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.</p> <p>This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.</p> <p>Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.</p> <p><strong>Affected:</strong> Bitnami: grafana</p> <p>Grafana is an open-source platform for monitoring and observability.</p> <p>The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.</p> <p>This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.</p> <p>Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.</p> https://cve.radiocsirt.org/vuln/bit-grafana-2023-2183 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0497 certfr-2023-avi-0497 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0497 https://cve.radiocsirt.org/vuln/euvd-2026-216203 EUVD-2026-216203 https://cve.radiocsirt.org/vuln/euvd-2026-216203 https://cve.radiocsirt.org/vuln/fkie_cve-2023-2183 <p>Grafana is an open-source platform for monitoring and observability.</p> <p>The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.</p> <p>This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.</p> <p>Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.</p> <p>Grafana is an open-source platform for monitoring and observability.</p> <p>The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.</p> <p>This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.</p> <p>Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-2183 https://cve.radiocsirt.org/vuln/ghsa-cvm3-pp2j-chr3 <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>### Summary Grafana allows an attacker in the Viewer role, send alerts by API Alert - Test. The option is not available from the user panel UI for in the Viewer role.</p> <p>**Reason for the error**: The API does not check access to this function and allows it by users with the least rights, for example, the Viewer that does not see this option in the user panel.</p> <p>This enables malicious users to abuse the functionality by sending multiple alert messages (e-mail, slack, etc…), spamming users, prepare Phishing attack or blocked SMTP server / IP and automatically moved all message to spam folder, add to black list IP.</p> <p>### Details The logged-in user, in the Viewer role, in the user panel, does not have access to the test option of sending an e-mail alert.</p> <p>View of the panel for the user in the Viewer role: </p> <p>Admin role - View panel for admin role: </p> <p>Admin role - Next step – editing: </p> <p>Admin role - Additional options: </p> <p>### PoC</p> <p>**HTTP Request by user in role Viewer** ``` POST /api/alertmanager/grafana/config/api/v1/receivers/test HTTP/1.1 Host: x…</p> <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>### Summary Grafana allows an attacker in the Viewer role, send alerts by API Alert - Test. The option is not available from the user panel UI for in the Viewer role.</p> <p>**Reason for the error**: The API does not check access to this function and allows it by users with the least rights, for example, the Viewer that does not see this option in the user panel.</p> <p>This enables malicious users to abuse the functionality by sending multiple alert messages (e-mail, slack, etc…), spamming users, prepare Phishing attack or blocked SMTP server / IP and automatically moved all message to spam folder, add to black list IP.</p> <p>### Details The logged-in user, in the Viewer role, in the user panel, does not have access to the test option of sending an e-mail alert.</p> <p>View of the panel for the user in the Viewer role: </p> <p>Admin role - View panel for admin role: </p> <p>Admin role - Next step – editing: </p> <p>Admin role - Additional options: </p> <p>### PoC</p> <p>**HTTP Request by user in role Viewer** ``` POST /api/alertmanager/grafana/config/api/v1/receivers/test HTTP/1.1 Host: x…</p> https://cve.radiocsirt.org/vuln/ghsa-cvm3-pp2j-chr3 https://cve.radiocsirt.org/vuln/gsd-2023-2183 gsd-2023-2183 https://cve.radiocsirt.org/vuln/gsd-2023-2183 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13027-1 <p>grafana-10.0.1-2.1 on GA media</p> <p>grafana-10.0.1-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13027-1 https://cve.radiocsirt.org/vuln/rhsa-2023:7740 <p>grafana: missing access control allows test alerts by underprivileged user grafana: data source proxy race condition</p> <p>grafana: missing access control allows test alerts by underprivileged user grafana: data source proxy race condition</p> https://cve.radiocsirt.org/vuln/rhsa-2023:7740 https://cve.radiocsirt.org/vuln/suse-su-2023:2915-1 <p>Security update for SUSE Manager Client Tools</p> <p>Security update for SUSE Manager Client Tools</p> https://cve.radiocsirt.org/vuln/suse-su-2023:2915-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-2183 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-2183 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1384 <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Zustand herbeizuführen.</p> <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1384