Vulnerability · Published Mar 7, 2024 · Assigned by GRAFANA
CVE-2024-1442User with permissions to create a data source can CRUD all data sources
Medium 6.0
In plain English
A medium-severity privilege mismanagement in Grafana from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.0Medium
Exploit odds (30 days)0.8%top 43.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/grafana/grafana | 9.5.7 | GHSA-5mxf-42f5-j782 |
| Go | github.com/grafana/grafana | 10.0.12 | GHSA-5mxf-42f5-j782 |
| Go | github.com/grafana/grafana | 10.1.8 | GHSA-5mxf-42f5-j782 |
| Go | github.com/grafana/grafana | 10.2.5 | GHSA-5mxf-42f5-j782 |
| Go | github.com/grafana/grafana | 10.3.4 | GHSA-5mxf-42f5-j782 |
| Go | github.com/grafana/grafana | no fix listed | GO-2024-2629 |
Affected products (as reported)
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L