=====================================================================

                                CERT-Renater

                    Note d'Information No. 2021/VULN610
_____________________________________________________________________

DATE                : 16/11/2021

HARDWARE PLATFOR, M(S): /

OPERATING SYSTEM(S): Systems running Grafana versions versions prior to
                                              8.2.4.

=====================================================================
https://github.com/grafana/grafana/security/advisories/GHSA-mpwp-42x6-4wmx
_____________________________________________________________________

Fine-grained access control enables organization admins to 
create/modify/delete user roles in other organization

critical	RichiH published GHSA-mpwp-42x6-4wmx


Package
Fine-grained access control (Grafana)

Affected versions
8.0.0 - 8.2.3

Patched versions
8.2.4


Description

Impact

On Nov. 2, during an internal security audit, we discovered that when
the fine-grained access control beta feature is enabled and there is
more than one organization in the Grafana instance, Grafana 8.0
introduced a mechanism which allowed users with the Organization Admin
role to list, add, remove, and update users’ roles in other
organizations in which they are not an admin.


Patches
Fixed in 8.2.4


Workarounds
All installations between v8.0 and v8.2.3 that have fine-grained access
control beta enabled and more than one organization should be upgraded
as soon as possible. If you cannot upgrade, you should turn off the
fine-grained access control using a feature flag.

Grafana Cloud instances have not been affected by the vulnerability.


Reporting security issues

If you think you have found a security vulnerability, please send a
report to security@grafana.com. This address can be used for all of
Grafana Labs' open source and commercial products (including, but not
limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com).
We can accept only vulnerability reports at this address. We would
prefer that you encrypt your message to us by using our PGP key. The key
fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.


Security announcements

We maintain a security category on our blog, where we will always post a
summary, remediation, and mitigation details for any patch containing
security fixes.


You can also subscribe to our RSS feed.


CVE ID
CVE-2021-41244

CVSS Score
9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================