Cloudanix VulnDB

CVE-2024-10452

Low · 2.2

Grafana org admin can delete pending invites in different org

CVSS

2.2

EPSS

0.5%

Published

Oct 29, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Admins in one group could remove sign-up invitations meant for a completely different group, letting them disrupt other teams' user sign-ups.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Authorization Bypass
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Authorization bypass allows organization administrators to delete pending invitation records belonging to any organization rather than only their own.

Why it matters to the business

Attackers with admin access in one organization can interfere with user onboarding processes in other organizations, causing operational disruption and potential loss of legitimate user registrations.

How an attack unfolds

An authenticated organization administrator identifies the invite deletion endpoint, supplies an identifier for an invite created in a different organization, and submits the request; the missing authorization check permits the deletion to succeed.

How to fix it

Upgrade Moodle packages on Ubuntu 16.04 LTS to version 2.7.11+dfsg-2 or later. After upgrade, verify that invite deletion operations are restricted to the administrator's own organization.

How to confirm the fix worked

Confirm installed Moodle package version is 2.7.11+dfsg-2 or newer. Test that an administrator cannot delete invites created in a different organization using both UI and API paths.

Typical attack path

  1. Obtain organization administrator credentials in a Moodle instance
  2. Enumerate or guess identifiers of pending invites from other organizations
  3. Send crafted HTTP request to the invite deletion endpoint using the cross-organization identifier
  4. Confirm successful deletion via application response or subsequent invite listing

How to detect it

Inspect web server access logs and application audit logs for invite deletion requests where the performing administrator's organization identifier does not match the invite's organization identifier; correlate with authentication events.

What your security team should do

  • Apply the fixed package version 2.7.11+dfsg-2 immediately on all affected Ubuntu 16.04 Moodle deployments
  • Review audit logs for any recent invite deletion events performed by administrators
  • Restrict organization administrator privileges to the minimum necessary personnel until patches are deployed

The record

Organization admins can delete pending invites created in an organization they are not part of.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/grafana/grafana 0 No fix
Bitnami grafana 0 10.4.13
Bitnami grafana 10.4.0 No fix
Chainguard grafana-11.2 0 11.2.10.01-r7
Chainguard grafana-11.2-oci-compat 0 11.2.10.01-r7
SUSE:Linux Enterprise Module for Package Hub 15 SP5 govulncheck-vulndb 0 0.0.20241104T154416-150000.1.12.1
SUSE:Linux Enterprise Module for Package Hub 15 SP6 govulncheck-vulndb 0 0.0.20241104T154416-150000.1.12.1
SUSE:Package Hub 12 govulncheck-vulndb 0 0.0.20241104T154416-5.1
Ubuntu:16.04:LTS grafana 0 No fix
Ubuntu:Pro:16.04:LTS grafana 0 No fix
Wolfi grafana-11.2 0 11.2.10.01-r7
Wolfi grafana-11.2-oci-compat 0 11.2.10.01-r7
openSUSE:Leap 15.5 govulncheck-vulndb 0 0.0.20241104T154416-150000.1.12.1
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20241104T154416-150000.1.12.1
openSUSE:Tumbleweed govulncheck-vulndb 0 0.0.20241104T154416-1.1

Related vulnerabilities