CVE-2024-1442
User with permissions to create a data source can CRUD all data sources
Summary
User with permissions to create a data source can CRUD all data sources
Original description
The description as published by the source.
A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.
Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
grafana
[{"type":"SEMVER","events":[{"introduced":"8.5.0"},{"fixed":"9.5.7"},{"introduced":"10.0.0"},{"fixed":"10.0.12"},{"introduced":"10.1.0"},{"fixed":"10.1.8"},{"introduced":"10.2.0"},{"fixed":"10.2.5"},{"introduced":"10.3.0"},{"fixed":"10.3.4"}]}]
References
- advisory grafana.com
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com