Skip to main content

Improper Privilege Management

CVE-2024-1442

High
8.7/10

Summary

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to '*'. Doing this will grant the user access to read, query, edit and delete all data sources within the organization. This issue affects versions 8.5.0 through 9.5.6, 10.0.0 through 10.0.11, 10.1.0 through 10.1.7, 10.2.0 through 10.2.4 and 10.3.0 through 10.3.3.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-269 - Improper Privilege Management

An effective privilege management infrastructure provides valid users with required access and privileges across heterogeneous technology environments. An application with a faulty privilege management infrastructure allows higher than authorized privileges or enables privilege escalation. This can lead to security incidents such as system infiltration, data breach, and complete system takeover.

References

Advisory Timeline

  • Published