A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
Weakness
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Grafana | Grafana | 8.5.0 (including) | 9.5.7 (excluding) |
| Grafana | Grafana | 10.0.0 (including) | 10.0.12 (excluding) |
| Grafana | Grafana | 10.1.0 (including) | 10.1.8 (excluding) |
| Grafana | Grafana | 10.2.0 (including) | 10.2.5 (excluding) |
| Grafana | Grafana | 10.3.0 (including) | 10.3.4 (excluding) |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-cli-rhel9:v2.12.0-17 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-cluster-permission-rhel9:v2.12.0-13 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-governance-policy-addon-controller-rhel9:v2.12.0-27 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-governance-policy-framework-addon-rhel9:v2.12.0-20 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-grafana-rhel9:v2.12.0-17 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-multicluster-observability-addon-rhel9:v2.12.0-20 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-must-gather-rhel9:v2.12.0-35 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-operator-bundle:v2.12.0-114 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-prometheus-config-reloader-rhel9:v2.12.0-16 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-prometheus-rhel9:v2.12.0-16 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-search-indexer-rhel9:v2.12.0-12 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-search-v2-api-rhel9:v2.12.0-15 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-search-v2-rhel9:v2.12.0-13 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-siteconfig-rhel9:v2.12.0-24 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/acm-volsync-addon-controller-rhel9:v2.12.0-22 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/cert-policy-controller-rhel9:v2.12.0-22 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/cluster-backup-rhel9-operator:v2.12.0-37 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/config-policy-controller-rhel9:v2.12.0-31 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/console-rhel9:v2.12.0-68 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/endpoint-monitoring-rhel9-operator:v2.12.0-39 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/governance-policy-propagator-rhel9:v2.12.0-29 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/grafana-dashboard-loader-rhel9:v2.12.0-39 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/insights-client-rhel9:v2.12.0-18 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/insights-metrics-rhel9:v2.12.0-18 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/klusterlet-addon-controller-rhel9:v2.12.0-12 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/kube-rbac-proxy-rhel9:v2.12.0-13 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/kube-state-metrics-rhel9:v2.12.0-17 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/memcached-exporter-rhel9:v2.12.0-10 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/memcached-rhel9:v2.12.0-7 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/metrics-collector-rhel9:v2.12.0-39 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/multicloud-integrations-rhel9:v2.12.0-12 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/multiclusterhub-rhel9:v2.12.0-51 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/multicluster-observability-rhel9-operator:v2.12.0-39 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/multicluster-operators-application-rhel9:v2.12.0-14 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/multicluster-operators-channel-rhel9:v2.12.0-12 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/multicluster-operators-subscription-rhel9:v2.12.0-24 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/node-exporter-rhel9:v2.12.0-10 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/observatorium-rhel9:v2.12.0-16 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/observatorium-rhel9-operator:v2.12.0-17 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/prometheus-alertmanager-rhel9:v2.12.0-12 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/prometheus-rhel9:v2.12.0-14 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/rbac-query-proxy-rhel9:v2.12.0-39 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/search-collector-rhel9:v2.12.0-21 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/submariner-addon-rhel9:v2.12.0-24 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/thanos-receive-controller-rhel9:v2.12.0-13 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | RedHat | rhacm2/thanos-rhel9:v2.12.0-18 | * |
| Red Hat Ceph Storage 6.1 | RedHat | rhceph/rhceph-6-dashboard-rhel9:6-90 | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/122.html
- https://cwe.mitre.org/data/definitions/233.html
- https://cwe.mitre.org/data/definitions/58.html