PT-2024-6557 · Grafana+1 · Grafana Agent+1
Published
2024-09-19
·
Updated
2024-11-05
·
CVE-2024-8996
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Grafana Agent versions prior to 0.43.2
Grafana Agent versions prior to 0.43.3
Description:
The issue is related to an Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows, which allows Privilege Escalation from Local User to SYSTEM. This vulnerability can be exploited by a local user to elevate their privileges.
Recommendations:
For versions prior to 0.43.2, update to version 0.43.2 or later to resolve the issue.
For versions prior to 0.43.3, update to version 0.43.3 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable
Grafana Agent (Flow mode) on Windows to minimize the risk of exploitation.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grafana Agent
Suse