CVE-2024-8118 — Grafana alerting wrong permission on datasource rule write endpoint

CVE-2024-8118

Grafana alerting wrong permission on datasource rule write endpoint PUBLISHED

Description (CNA)

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

Affected (CNA)

Vendor / product	Versions
Grafana / Grafana	affected 8.5.0 before 10.3.10; affected 10.4.0 before 10.4.9; affected 11.0.0 before 11.0.5; affected 11.1.0 before 11.1.6; affected 11.2.0 before 11.2.1

CWE

CWE-653

References

https://grafana.com/security/security-advisories/cve-2024-8118/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.