A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.
Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 5
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Grafana Grafana
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
|
— |
11.6.11
|
|
Grafana Grafana
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
|
12.0.0
|
12.0.9
|
|
Grafana Grafana
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
|
12.1.0
|
12.1.6
|
|
Grafana Grafana
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
|
12.2.0
|
12.2.4
|
|
Grafana Grafana
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
|
12.3.0
|
12.3.3
|