Executive Summary

This vulnerability affects StorageGRID versions prior to 11.9.0.13 and 12.0.0.6. It is an Information Disclosure vulnerability that allows an authenticated attacker with low privileges to run arbitrary metrics queries. By exploiting this, the attacker can access metric results that they are not authorized to see.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker with low-level access can obtain sensitive information through unauthorized metrics queries. This could lead to exposure of internal system metrics or data that should be restricted, potentially aiding further attacks or information gathering.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated attacker with low privileges to run arbitrary metrics queries, potentially revealing metric results they should not have access to.

Such unauthorized information disclosure could impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to sensitive information.

However, the provided information does not specify the nature of the disclosed metrics or whether they include personal or protected health information.

Useful 0 Not Useful 0