GHSA-hh8p-374f-qgr5
Grafana plugin data sources vulnerable to access control bypass
At a glance
- Published
- Updated
- CVE
- CVE-2024-6322
- Aliases
- BIT-grafana-2024-6322, GO-2024-3079
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L
Description
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/grafana/grafana | introduced 11.1.0, fixed 11.1.1 |
| Go · github.com/grafana/grafana | introduced 11.1.2, fixed 11.1.3 |
| Go · github.com/grafana/grafana | introduced 0.0.0-20240521130516-0072e4a92d89, fixed 0.0.0-20240725142242-c326d865c58b |
| Go · github.com/grafana/grafana | introduced 1.9.2-0.20240521130516-0072e4a92d89, fixed 1.9.2-0.20240725142242-c326d865c58b |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-6322 ADVISORY
- https://github.com/grafana/grafana/commit/4cb3ba5d1a7ab8b9676034e89dada2fcde1766ef WEB
- https://github.com/grafana/grafana/commit/9cdba084a9100c6b11d32eef9d2bd53656c6964a WEB
- https://github.com/grafana/grafana PACKAGE
- https://grafana.com/security/security-advisories/cve-2024-6322 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |