CVE-2023-2183 Grafana has Broken Access Control in Alert manager: Viewer can send test alerts
Attackers with Viewer role can bypass UI restrictions to send test alerts via API, enabling spam or phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-2183?
CVE-2023-2183 is a medium-severity missing authorization vulnerability in Grafana Grafana, published on 6 Jun 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Grafana is an open-source platform for monitoring and observability.
The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.
This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.
Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.
Which versions are affected by CVE-2023-2183?
11 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | 8.5.26 |
github.com/grafana/grafana Go | All versions | 8.5.26 |
github.com/grafana/grafana Go | From 9.0.0 | 9.2.19 |
github.com/grafana/grafana Go | From 9.0.0 | 9.2.19 |
github.com/grafana/grafana Go | From 9.3.0 | 9.3.15 |
github.com/grafana/grafana Go | From 9.3.0 | 9.3.15 |
5 more packages
github.com/grafana/grafana Go | From 9.4.0 | 9.4.12 |
github.com/grafana/grafana Go | From 9.4.0 | 9.4.12 |
github.com/grafana/grafana Go | From 9.5.0 | 9.5.3 |
github.com/grafana/grafana Go | From 9.5.0 | 9.5.3 |
grafana Bitnami | From 8.0.0 | 8.5.26, 9.2.19, 9.3.15, 9.4.12, 9.5.3 |
Products include Grafana Grafana.
How do I fix CVE-2023-2183?
Upgrade github.com/grafana/grafana to a fixed version for your release line: 8.5.26, 9.2.19, 9.3.15 or 9.4.12.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-2183 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-2183 exists.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2023-2183, GHSA-cvm3-pp2j-chr3, UBUNTU-CVE-2023-2183.