high7.3
CVE-2024-8996
Grafana Agent (Flow mode) on Windows has Unquoted Search Path or Element vulnerability
Impact
Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM. This issue affects Agent Flow before 0.43.3.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/grafana/agent | < 0.43.3 | 0.43.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grafana | Agent | before 0.43.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/grafana/agent/releases/tag/v0.43.3
- https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996/
- https://grafana.com/security/security-advisories/cve-2024-8996/
- https://github.com/advisories/GHSA-m5gv-m5f9-wgv4
- https://nvd.nist.gov/vuln/detail/CVE-2024-8996
- https://github.com/grafana/agent/releases/tag/v0.43.2
- https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996
- https://grafana.com/security/security-advisories/cve-2024-8996
- https://github.com/grafana/agent/commit/91bab2c05906938d3f8e1e3c61a863f037985299
- https://pkg.go.dev/vuln/GO-2024-3170