Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2024-1442

User with permissions to create a data source can CRUD all data sources

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana

Default version status: unaffected

  • 8.5.0 to < 9.5.7affected
  • 10.0.0 to < 10.0.12affected
  • 10.1.0 to < 10.1.8affected
  • 10.2.0 to < 10.2.5affected
  • 10.3.0 to < 10.3.4affected

References