CVE-2024-1442
Fixed in a distro release EPSS <1%CVSS 6.0
A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
Products: grafana
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/grafana | 9.5.7 |
| Go | github.com/grafana/grafana | 10.0.12 |
| Go | github.com/grafana/grafana | 10.1.8 |
| Go | github.com/grafana/grafana | 10.2.5 |
| Go | github.com/grafana/grafana | 10.3.4 |
| Go | github.com/grafana/grafana | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana | 10.4.0-r0 |
| Chainguard | grafana-fips-11.6 | 0 |
| Chainguard | grafana-fips-12.0 | 12.0.10-r6 |
| Chainguard | grafana-fips-12.1 | 12.1.10.01-r3 |
| Chainguard | grafana-fips-12.2 | 0 |
| Chainguard | grafana-fips-12.3 | 0 |
| Chainguard | grafana-fips-12.4 | 0 |
| Chainguard | grafana-fips-13.0 | 0 |
| Chainguard | grafana-fips-13.1 | 13.1.0-r0 |
| Ubuntu 16.04 LTS | grafana | no fix |
| Wolfi | grafana | 10.4.0-r0 |