Patchwire CVEs, their patch status, and feeds to follow them

CVE-2024-1313

Fixed in a distro release EPSS <1%CVSS 6.5

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability. This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.

Published 2024-03-26 · CVE record · OSV

Products: grafana

Fixed upstream

EcosystemPackageFixed in
Gogithub.com/grafana/grafana9.5.18
Gogithub.com/grafana/grafana10.0.13
Gogithub.com/grafana/grafana10.1.9
Gogithub.com/grafana/grafana10.2.6
Gogithub.com/grafana/grafana10.3.5
Gogithub.com/grafana/grafanano fix

Distro releases

ReleasePackageFixed in
AlmaLinux 8grafana9.2.10-16.el8_10
AlmaLinux 8grafana-selinux9.2.10-16.el8_10
AlmaLinux 9grafana9.2.10-16.el9_4.alma.1
AlmaLinux 9grafana-selinux9.2.10-16.el9_4.alma.1
Chainguardgrafana-fips-11.60
Chainguardgrafana-fips-12.012.0.10-r6
Chainguardgrafana-fips-12.112.1.10.01-r3
Chainguardgrafana-fips-12.20
Chainguardgrafana-fips-12.30
Chainguardgrafana-fips-12.40
Chainguardgrafana-fips-13.00
Chainguardgrafana-fips-13.113.1.0-r0
Red Hat Enterprise Linux 8grafana0:9.2.10-16.el8_10
Red Hat Enterprise Linux 8grafana-debuginfo0:9.2.10-16.el8_10
Red Hat Enterprise Linux 8grafana-debugsource0:9.2.10-16.el8_10
Red Hat Enterprise Linux 8grafana-selinux0:9.2.10-16.el8_10
Red Hat Enterprise Linux 9grafana0:9.2.10-16.el9_4
Red Hat Enterprise Linux 9grafana-debuginfo0:9.2.10-16.el9_4
Red Hat Enterprise Linux 9grafana-debugsource0:9.2.10-16.el9_4
Red Hat Enterprise Linux 9grafana-selinux0:9.2.10-16.el9_4
Rocky Linux 8grafana0:9.2.10-16.el8_10
Rocky Linux 9grafana0:9.2.10-16.el9_4
SUSE Linux Enterprise Module for Package Hub 15 SP5golang-github-prometheus-promu0.14.0-150000.3.18.2
SUSE Linux Enterprise Module for Package Hub 15 SP5grafana9.5.18-150200.3.56.1
SUSE Linux Enterprise Module for Package Hub 15 SP6grafana9.5.18-150200.3.56.1
SUSE Linux Enterprise Server 12 SP5golang-github-prometheus-node_exporter1.7.0-1.30.2
SUSE Linux Enterprise Server for SAP Applications 12 SP5golang-github-prometheus-node_exporter1.7.0-1.30.2
SUSE Manager Client Tools 12golang-github-prometheus-alertmanager0.26.0-1.27.2
SUSE Manager Client Tools 12golang-github-prometheus-node_exporter1.7.0-1.30.2
SUSE Manager Client Tools 12golang-github-prometheus-promu0.14.0-1.18.1
SUSE Manager Client Tools 12grafana9.5.18-1.63.1
SUSE Manager Client Tools 12mgr-daemon4.3.9-1.47.1
SUSE Manager Client Tools 12spacecmd4.3.27-38.139.1
SUSE Manager Client Tools 12spacewalk-client-tools4.3.19-52.98.1
SUSE Manager Client Tools 12spacewalk-koan4.3.6-24.36.1
SUSE Manager Client Tools 12uyuni-common-libs4.3.10-1.39.1
SUSE Manager Client Tools 12-BETAgrafana9.5.18-4.30.4
SUSE Manager Client Tools 12-BETAmgr-push5.0.2-4.24.5
SUSE Manager Client Tools 12-BETAspacecmd5.0.6-41.51.3
SUSE Manager Client Tools 12-BETAuyuni-common-libs5.0.3-3.39.3
SUSE Manager Client Tools 12-BETAuyuni-tools0.1.9-3.11.4
SUSE Manager Client Tools 15POS_Image-Graphical70.1.1710765237.46af599-150000.1.21.2
SUSE Manager Client Tools 15POS_Image-JeOS70.1.1710765237.46af599-150000.1.21.2
SUSE Manager Client Tools 15ansible2.9.27-150000.1.17.2
SUSE Manager Client Tools 15dracut-saltboot0.1.1710765237.46af599-150000.1.53.2
SUSE Manager Client Tools 15grafana9.5.18-150000.1.63.2
SUSE Manager Client Tools 15mgr-daemon4.3.9-150000.1.47.2
SUSE Manager Client Tools 15spacecmd4.3.27-150000.3.116.2
SUSE Manager Client Tools 15spacewalk-client-tools4.3.19-150000.3.89.2
SUSE Manager Client Tools 15spacewalk-koan4.3.6-150000.3.33.2
SUSE Manager Client Tools 15uyuni-common-libs4.3.10-150000.1.39.2
SUSE Manager Client Tools 15uyuni-proxy-systemd-services4.3.12-150000.1.21.2
SUSE Manager Client Tools 15-BETAgrafana9.5.18-159000.4.33.4
SUSE Manager Client Tools 15-BETAmgr-push5.0.2-159000.4.24.5
SUSE Manager Client Tools 15-BETAspacecmd5.0.6-159000.6.51.4
SUSE Manager Client Tools 15-BETAuyuni-common-libs5.0.3-159000.3.39.3
SUSE Manager Client Tools 15-BETAuyuni-tools0.1.9-159000.3.11.5
SUSE Manager Client Tools Beta for SLE Micro 5golang-github-prometheus-node_exporter1.7.0-159000.6.5.5
SUSE Manager Client Tools Beta for SLE Micro 5uyuni-tools0.1.9-159000.3.11.5
SUSE Manager Client Tools for SLE Micro 5dracut-saltboot0.1.1710765237.46af599-150000.1.53.2
SUSE Manager Client Tools for SLE Micro 5uyuni-proxy-systemd-services4.3.12-150000.1.21.2
SUSE Manager Proxy Module 4.3ansible2.9.27-150000.1.17.2
SUSE Manager Proxy Module 4.3uyuni-proxy-systemd-services4.3.12-150000.1.21.2
Ubuntu 16.04 LTSgrafanano fix
openSUSE Leap 15.5POS_Image-Graphical70.1.1710765237.46af599-150000.1.21.2
openSUSE Leap 15.5POS_Image-JeOS70.1.1710765237.46af599-150000.1.21.2
openSUSE Leap 15.5ansible2.9.27-150000.1.17.2
openSUSE Leap 15.5dracut-saltboot0.1.1710765237.46af599-150000.1.53.2
openSUSE Leap 15.5golang-github-prometheus-promu0.14.0-150000.3.18.2
openSUSE Leap 15.5grafana9.5.18-150200.3.56.1
openSUSE Leap 15.5mybatis3.5.6-150200.5.6.1
openSUSE Leap 15.5spacecmd4.3.27-150000.3.116.2
openSUSE Leap 15.6grafana9.5.18-150200.3.56.1
openSUSE Leap 15.6mybatis3.5.6-150200.5.6.1
openSUSE Tumbleweedgrafana10.3.5-1.1