Vulnerability · Published Aug 20, 2024 · Assigned by GRAFANA
CVE-2024-6322
Medium 4.4
In plain English
A medium-severity security flaw in Grafana from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/grafana/grafana | 11.1.1 | GHSA-hh8p-374f-qgr5 |
| Go | github.com/grafana/grafana | 11.1.3 | GHSA-hh8p-374f-qgr5 |
| Go | github.com/grafana/grafana | 0.0.0-20240725142242-c326d865c58b | GHSA-hh8p-374f-qgr5 |
| Go | github.com/grafana/grafana | 1.9.2-0.20240725142242-c326d865c58b | GHSA-hh8p-374f-qgr5 |
| Go | github.com/grafana/grafana | no fix listed | GO-2024-3079 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana | 11.1.0 – before 11.1.111.1.2 – before 11.1.3 |
| Grafana | Grafana Enterprise | 11.1.0 – before 11.1.111.1.2 – before 11.1.3 |
Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L