Description
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Grafana Grafana OSS
Default version status: unaffected
8.0.0 to ≤ 11.0.0affected11.0.0 to ≤ 11.6.10affected12.0.0 to ≤ 12.0.9affected12.1.0 to ≤ 12.1.6affected12.2.0 to ≤ 12.2.4affected12.3.0 to ≤ 12.3.2affected