An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.

grafana: OAuth and OIDC tokens written unredacted to Grafana server logs grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled fast-uri: fast-uri: Path traversal via improper relative URI normalization fast-uri: fast-uri: Security policy bypass via improper host canonicalization fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths body-parser: body-parser: Denial of Service via unhandled decompression stream error

Affected: Ubuntu:16.04:LTS: grafana

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.