high6.0
CVE-2024-1442
Grafana's users with permissions to create a data source can CRUD all data sources
Impact
A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/grafana/grafana | >= 8.5.0, < 9.5.7 | 9.5.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grafana | Grafana | from 8.5.0 before 9.5.7 from 10.0.0 before 10.0.12 from 10.1.0 before 10.1.8 from 10.2.0 before 10.2.5 from 10.3.0 before 10.3.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://grafana.com/security/security-advisories/cve-2024-1442/
- https://security.netapp.com/advisory/ntap-20241122-0007/
- https://github.com/advisories/GHSA-5mxf-42f5-j782
- https://nvd.nist.gov/vuln/detail/CVE-2024-1442
- https://grafana.com/security/security-advisories/cve-2024-1442
- https://security.netapp.com/advisory/ntap-20241122-0007