CVE-2024-6322
Medium
Description
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
SeverityMedium
CVSS5.4
Exploit probability—
ProductGithub.com/grafana/grafana
PublishedAug 20, 2024
First seenAug 20, 2024
Weakness typeCWE-266CWE-266
How to fix
Update
- github.com/grafana/grafana11.1.1, 11.1.3, 0.0.0-20240725142242-c326d865c58b, 1.9.2-0.20240725142242-c326d865c58b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/grafana/grafanaGo | 11.1.0 ≤ v < 11.1.1, 11.1.2 ≤ v < 11.1.3, 0.0.0-20240521130516-0072e4a92d89 ≤ v < 0.0.0-20240725142242-c326d865c58b, 1.9.2-0.20240521130516-0072e4a92d89 ≤ v < 1.9.2-0.20240725142242-c326d865c58b, No range specified | 11.1.1, 11.1.3, 0.0.0-20240725142242-c326d865c58b, 1.9.2-0.20240725142242-c326d865c58b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.