Bug 1937278 (CVE-2021-27962) - CVE-2021-27962 grafana: users with editor role allows to bypass data source permissions
Summary: CVE-2021-27962 grafana: users with editor role allows to bypass data source p...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2021-27962
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1937242
TreeView+ depends on / blocked
 
Reported: 2021-03-10 09:19 UTC by msiddiqu
Modified: 2023-08-31 23:41 UTC (History)
41 users (show)

Fixed In Version: Grafana Enterprise 7.4.5
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Grafana Enterprise. Users with the Editor role are allowed to bypass data source permissions for the organization's default data source. The highest threat from this vulnerability is to data confidentiality.
Clone Of:
Environment:
Last Closed: 2021-03-18 19:51:44 UTC
Embargoed:

Attachments (Terms of Use)

Description msiddiqu 2021-03-10 09:19:43 UTC 
Grafana Enterprise 7.2.0 introduced a mechanism which allowed users with the Editor role to bypass data source permissions for the organization’s default data source.
Comment 1 Jan Kurik 2021-03-10 10:27:18 UTC 
Side note:
* Released RHEL-8.3 contains grafana-6.7.4
* Not yet release RHEL-8.4 contains grafana-7.3.6
Comment 2 Jan Kurik 2021-03-10 10:30:56 UTC 
Taus, can you please share more info, so we can start working on a reproducer and a fix ?
Comment 5 msiddiqu 2021-03-10 13:32:38 UTC 
(In reply to Jan Kurik from comment #2)
> Taus, can you please share more info, so we can start working on a
> reproducer and a fix ?

Jan, Are you asking about RHEL specifically? Platforms Analysis team will create trackers if needed and they may add more information there.
Comment 6 Jan Kurik 2021-03-10 14:19:32 UTC 
Yes, I was asking about grafana in RHEL.
I will wait for the info from Platforms Analysis team. Thanks for the info.
Comment 9 Przemyslaw Roguski 2021-03-11 11:46:04 UTC 
Statement:

Red Hat products do not ship Grafana Enterprise version, therefore are not affected by this vulnerability.
Comment 10 Przemyslaw Roguski 2021-03-11 11:46:11 UTC 
Mitigation:

If you are using the Enterprise version of Grafana, you can mitigate this vulnerability by making sure that the default data source for every Grafana organization points to a data source without permissions set up.
Comment 11 Przemyslaw Roguski 2021-03-18 17:44:14 UTC 
External References:

https://github.com/grafana/grafana/blob/master/CHANGELOG.md#745-2021-03-18
Comment 12 Product Security DevOps Team 2021-03-18 19:51:44 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27962
Note You need to log in before you can comment on or make changes to this bug.