Grafana Grafana
At a glance
- Source
- NVD
- EPSS
- EPSS 0.30 % · percentile 23 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GRAFANA
- NVD status
- Deferred
Description
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
Weaknesses (CWE)
- CWE-266 — Incorrect Privilege Assignment
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L | GRAFANA |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L | NVD · security@grafana.com (Secondary) |
Advisories
- GHSA-hh8p-374f-qgr5 — Grafana plugin data sources vulnerable to access control bypass
- GO-2024-3079 — Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana
European references
- ENISA EUVD · EUVD-2024-2596
- GCVE · GCVE-0-2024-6322
Affected products
| Product | Versions |
|---|---|
| Grafana · Grafana | affected 11.1.0 < 11.1.1 ; affected 11.1.2 < 11.1.3 |
| Grafana · Grafana Enterprise | affected 11.1.0 < 11.1.1 ; affected 11.1.2 < 11.1.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |