Grafana Information Leakage Vulnerability in Alerting System

A vulnerability exists in Grafana's alerting system, specifically in versions greater than 8.0.0 and through 12.3.0. Users with edit permissions for a contact point, particularly those holding the 'Contact Point Writer' role, can modify contact points created by others. This includes changing the endpoint URL to a server under their control. By using the test functionality, these users can intercept and retrieve redacted secure settings, such as authentication tokens for third-party services like Slack. This exploitation could lead to unauthorized access and compromise of external integrations.

Impact

Exploitation of this vulnerability could result in unauthorized access to and compromise of external integrations by leaking sensitive authentication credentials, such as Slack tokens.

Remediation

Users can upgrade to Grafana version 12.4 or later to address this vulnerability.