Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2024-1442

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

VectorNETWORK

PublishedMar 07, 2024, 18:15

Published Bysecurity@grafana.com

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/grafana/grafana(Go)8.5.09.5.7N/A

github.com/grafana/grafana(Go)10.0.010.0.12N/A

github.com/grafana/grafana(Go)10.1.010.1.8N/A

github.com/grafana/grafana(Go)10.2.010.2.5N/A

github.com/grafana/grafana(Go)10.3.010.3.4N/A

References

https://grafana.com/security/security-advisories/cve-2024-1442/
https://security.netapp.com/advisory/ntap-20241122-0007/

Weakness Type

NVD-CWE-noinfo

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK