Skip to content
CVE PROGRAM SOURCE RECORD4.4 Medium

CVE-2024-6322

Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any othe

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana

  • 11.1.0 to < 11.1.1affected
  • 11.1.2 to < 11.1.3affected

Grafana Grafana Enterprise

  • 11.1.0 to < 11.1.1affected
  • 11.1.2 to < 11.1.3affected

References