Grafana Grafana
En bref
- Source
- NVD
- EPSS
- EPSS 0.30 % · centile 23 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GRAFANA
- Statut NVD
- Deferred
Description
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
Faiblesses (CWE)
- CWE-266 — Incorrect Privilege Assignment
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L | GRAFANA |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L | NVD · security@grafana.com (Secondary) |
Avis
- GHSA-hh8p-374f-qgr5 — Grafana plugin data sources vulnerable to access control bypass
- GO-2024-3079 — Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana
Références européennes
- ENISA EUVD · EUVD-2024-2596
- GCVE · GCVE-0-2024-6322
Produits affectés
| Produit | Versions |
|---|---|
| Grafana · Grafana | affected 11.1.0 < 11.1.1 ; affected 11.1.2 < 11.1.3 |
| Grafana · Grafana Enterprise | affected 11.1.0 < 11.1.1 ; affected 11.1.2 < 11.1.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |