← CVE Intelligence

CVE-2024-1442

User with permissions to create a data source can CRUD all data sources PUBLISHED

Description (CNA)

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

Affected (CNA)

Vendor / productVersions
Grafana / Grafanaaffected 8.5.0 before 9.5.7; affected 10.0.0 before 10.0.12; affected 10.1.0 before 10.1.8; affected 10.2.0 before 10.2.5; affected 10.3.0 before 10.3.4

CWE

CWE-269

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.