Summary Grafana is used by IBM Storage Ceph as a metrics dashboard. This bulletin identifies the steps to take to address the vulnerability in Grafana. CVE-2024-1313 Vulnerability Details CVEID:CVE-2024-1313 DESCRIPTION: It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability. This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5. CWE:CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM X-Force CVSS Base score: 6.5 CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Affected Products and Versions Affected Product(s)| Version(s) —|— IBM Storage Ceph| 7.0, 7.1z0-z2 IBM Storage Ceph| 6.0, 6.1z0-z9 IBM Storage Ceph| 5.3z0-z6 Remediation/Fixes IBM strongly recommends addressing the vulnerability now. Download the latest version of IBM Storage Ceph and upgrade to 7.1z3 by…Read More
Security Bulletin: IBM Storage Ceph is vulnerable to Authorization Bypass in Grafana (CVE-2024-1313)
