Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

According to its self-reported version, the Grafana install hosted on the remote host is earlier than 8.5.26, or earlier than 9.2.19, or earlier than 9.3.15, or earlier than 9.4.12, or 9.5.x earlier than 9.5.3. It is, therefore, affected by multiple vulnerabilities:

- A Missing Authorization vulnerability.

- A Missing Synchronization vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Grafana is an open-source platform for monitoring and observability. The option to send a test alert is     not available from the user panel UI for users having the Viewer role. It is still possible for a user     with the Viewer role to send a test alert using the API as the API does not check access to this function.
    This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail     and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version     9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix. (CVE-2023-2183)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7740 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous enhancements, and bug fixes. Space precludes documenting all of these     changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on     the most significant of these changes:

    https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/6.1/html/release_notes/index

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2917-1 advisory.

  - Grafana is an open-source platform for monitoring and observability. The option to send a test alert is     not available from the user panel UI for users having the Viewer role. It is still possible for a user     with the Viewer role to send a test alert using the API as the API does not check access to this function.
    This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail     and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version     9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix. (CVE-2023-2183)

  - Grafana is an open-source platform for monitoring and observability. Using public dashboards users can     query multiple distinct data sources using mixed queries. However such query has a possibility of crashing     a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's     also possible to cause this by calling the query API directly. This might enable malicious users to crash     Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
    (CVE-2023-2801)

  - Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is     not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure     AD OAuth is configured with a multi-tenant app. (CVE-2023-3128)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6c1de144-056f-11ee-8e16-6c3be5272acd advisory.

  - Grafana is an open-source platform for monitoring and observability. The option to send a test alert is     not available from the user panel UI for users having the Viewer role. It is still possible for a user     with the Viewer role to send a test alert using the API as the API does not check access to this function.
    This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail     and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version     9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix. (CVE-2023-2183)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114854	Grafana 9.5.x < 9.5.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
114853	Grafana < 9.4.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
114852	Grafana < 9.3.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
114851	Grafana < 9.2.19 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
114850	Grafana < 8.5.26 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
225861	Linux Distros Unpatched Vulnerability : CVE-2023-2183	Nessus	Misc.	medium
186760	RHEL 9 : Red Hat Ceph Storage 6.1 (RHSA-2023:7740)	Nessus	Red Hat Local Security Checks	medium
178694	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:2917-1)	Nessus	SuSE Local Security Checks	critical
176943	FreeBSD : Grafana -- Broken access control: viewer can send test alerts (6c1de144-056f-11ee-8e16-6c3be5272acd)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2023-2183

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

critical

medium