CVE-2024-1442
CVE-2024-1442 · User with permissions to create a data source can CRUD all data sources
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
CVSS 6.0 · Medium · EPSS 0.8% · Fix available
- Published
- Updated
Stack: system · applications
Affected products and versions
grafana
- Versions
- ≥ 8.5.0, < 9.5.7: Affected (semver)
- ≥ 10.0.0, < 10.0.12: Affected (semver)
- ≥ 10.1.0, < 10.1.8: Affected (semver)
- ≥ 10.2.0, < 10.2.5: Affected (semver)
- ≥ 10.3.0, < 10.3.4: Affected (semver)
Update to 10.0.12; Update to 10.1.8; Update to 10.2.5; Update to 10.3.4; Update to 9.5.7
grafana Ubuntu:16.04:LTS
- Versions
- 2.6.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published