Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2024-8118

Grafana alerting wrong permission on datasource rule write endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana

Default version status: unaffected

  • 8.5.0 to < 10.3.10affected
  • 10.4.0 to < 10.4.9affected
  • 11.0.0 to < 11.0.5affected
  • 11.1.0 to < 11.1.6affected
  • 11.2.0 to < 11.2.1affected

References