Access Control Bypass Affecting github.com/grafana/grafana/pkg/services/ngalert/api package, versions <8.5.26 >=9.2.0 <9.2.19 >=9.3.0 <9.3.15 >=9.4.0 <9.4.12 >=9.5.0 <9.5.3
Threat Intelligence
EPSS
0.09% (41st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMGRAFANAGRAFANAPKGSERVICESNGALERTAPI-5669045
- published 7 Jun 2023
- disclosed 7 Jun 2023
- credit Unknown
Introduced: 7 Jun 2023
CVE-2023-2183 Open this link in a new tabHow to fix?
Upgrade github.com/grafana/grafana/pkg/services/ngalert/api to version 8.5.26, 9.2.19, 9.3.15, 9.4.12, 9.5.3 or higher.
Overview
Affected versions of this package are vulnerable to Access Control Bypass when it is possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.
Exploiting this vulnerability allows users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, preparing Phishing attacks, or blocking SMTP servers.
References
CVSS Scores
version 3.1