CVE-2024-8118
CVE-2024-8118 · Grafana alerting wrong permission on datasource rule write endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.
CVSS 5.1 · Medium · EPSS 0.6% · Fix available
- Published
- Updated
Stack: system · applications
Affected products and versions
grafana
- Versions
- ≥ 8.5.0, < 10.3.10: Affected (semver)
- ≥ 10.4.0, < 10.4.9: Affected (semver)
- ≥ 11.0.0, < 11.0.5: Affected (semver)
- ≥ 11.1.0, < 11.1.6: Affected (semver)
- ≥ 11.2.0, < 11.2.1: Affected (semver)
Update to 10.3.10; Update to 10.4.9; Update to 11.0.5; Update to 11.1.6; Update to 11.2.1
grafana Ubuntu:16.04:LTS
- Versions
- 2.6.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published