Description
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Grafana Grafana Enterprise
Default version status: unaffected
12.4.0 to ≤ 12.4.13affected13.0.0 to ≤ 13.0.11affected13.1.0 to ≤ 13.1.8affected13.2.0 to ≤ 13.2.4affected
Grafana Grafana OSS
Default version status: unaffected
12.4.0 to ≤ 12.4.13affected13.0.0 to ≤ 13.0.11affected13.1.0 to ≤ 13.1.8affected13.2.0 to ≤ 13.2.4affected