Alerting contact point authorization bypass via schema downgrade
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The alerting contact point feature of this software is affected. A user who can edit contact points, but not their protected fields, can change protected settings such as the destination URL by switching an integration to an older schema, which can expose stored credentials and redirect alert notifications.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Grafana Grafana Enterprise
From 12.4.0 · through 12.4.13; From 13.0.0 · through 13.0.11; From 13.1.0 · through 13.1.8; From 13.2.0 · through 13.2.4
- Grafana Grafana OSS
From 12.4.0 · through 12.4.13; From 13.0.0 · through 13.0.11; From 13.1.0 · through 13.1.8; From 13.2.0 · through 13.2.4