PT-2024-37543 · Grafana · Grafana
Published
2024-08-20
·
Updated
2025-10-30
·
CVE-2024-6322
CVSS v4.0
5.9
Medium
| Vector | AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L |
Name of the Vulnerable Software and Affected Versions:
Grafana versions 11.1.0 through 11.1.1
Grafana versions 11.1.2 through 11.1.3
Description:
Access control for plugin data sources protected by the
ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.Recommendations:
For Grafana versions 11.1.0 through 11.1.1, update to version 11.1.1 or later.
For Grafana versions 11.1.2 through 11.1.3, update to version 11.1.3 or later.
As a temporary workaround, consider restricting access to plugin data sources to minimize the risk of exploitation.
Fix
Incorrect Privilege Assignment
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grafana