CVE-2024-8986 — Information Leakage in grafana-plugin-sdk-go

CVE-2024-8986

Information Leakage in grafana-plugin-sdk-go PUBLISHED

Description (CNA)

The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running `git remote get-url origin`. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.

Affected (CNA)

Vendor / product	Versions
grafana-plugin-sdk-go / Grafana Plugin SDK	affected 0.106.0 through 0.249.0

CWE

CWE-522

References

https://grafana.com/security/security-advisories/cve-2024-8986/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.