GHSA-5mxf-42f5-j782HighCVSS 6.0

Grafana's users with permissions to create a data source can CRUD all data sources

Published
March 7, 2024
Last Modified
November 22, 2024

🔗 CVE IDs covered (1)

CVE-2024-1442 →

📋 Description

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

🎯 Affected products5

  • go/github.com/grafana/grafana:>= 8.5.0, < 9.5.7
  • go/github.com/grafana/grafana:>= 10.0.0, < 10.0.12
  • go/github.com/grafana/grafana:>= 10.1.0, < 10.1.8
  • go/github.com/grafana/grafana:>= 10.2.0, < 10.2.5
  • go/github.com/grafana/grafana:>= 10.3.0, < 10.3.4

🔗 References (4)