high7.3
CVE-2024-8975
Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability
Impact
Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM. This issue affects Alloy: before 1.3.4, from 1.4.0-rc.0 and prior to 1.4.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/grafana/alloy | < 1.3.4 | 1.3.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grafana | Alloy | before 1.3.3 Version 1.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/grafana/alloy/releases/tag/v1.3.4
- https://github.com/grafana/alloy/releases/tag/v1.4.1
- https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996/
- https://grafana.com/security/security-advisories/cve-2024-8975/
- https://github.com/advisories/GHSA-chqx-36rm-rf8h
- https://nvd.nist.gov/vuln/detail/CVE-2024-8975
- https://github.com/grafana/alloy/releases/tag/v1.4.0
- https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996
- https://grafana.com/security/security-advisories/cve-2024-8975
- https://github.com/grafana/alloy/commit/88e779887690954c009503598a3f4bf563cb6596
- https://github.com/grafana/alloy/commit/f14249012fd970d3fd73604e6fff9b6c7990a9bb
- https://pkg.go.dev/vuln/GO-2024-3168