CVE-2024-1442: User with permissions to create a data source can CRUD all data sources
Analyzed
AliasesUBUNTU-CVE-2024-1442GHSA-5mxf-42f5-j782BIT-grafana-2024-1442GO-2024-2629CGA-29vq-qg7v-9mxxCGA-2gc8-fjqx-v4mcCGA-42wc-mj5h-4464CGA-46wg-pfmv-w2wgCGA-48g2-pg8m-vfwxCGA-5g75-fc57-3h34CGA-6rq5-8vc5-jpm2CGA-73q9-2q73-g5wjCGA-7hv6-2crc-pffvCGA-7q6h-86w3-mqfwCGA-8r5p-h4wf-68pgCGA-94gq-65h7-93mpCGA-975v-qcr3-f9qfCGA-9mj2-hpg3-pjqwCGA-9vx8-c8q4-c5gqCGA-cgxm-5j56-q2xxCGA-cqpw-4p8p-fghwCGA-f35f-r8j3-9v9cCGA-gjr5-j6cg-64m7CGA-hffr-7p26-m9qmCGA-j5h6-vmwc-jg5qCGA-jr7w-3999-6m4xCGA-m636-qp3g-h33vCGA-m84w-w5x7-6r58CGA-m86r-9x2c-w5rrCGA-mm2c-gwhg-j227CGA-p2pq-mq99-hhgqCGA-pprr-8fhw-vqmgCGA-q4pm-c6f8-8cpxCGA-qg55-j796-v57qCGA-qhpj-j7g3-g7h6CGA-qjq7-r669-cj5fCGA-qvwv-mgcv-qp4qCGA-rqq8-v4pp-j583CGA-rxmg-9wxq-xghjCGA-vqjv-7v38-5g53CGA-wc7j-pj3r-m75wCGA-wcwv-9q6m-3xw2CGA-wr8m-rgph-3p35CGA-x5hh-v9jr-rrf3
Published 07-03-2024Last modified 22-11-2024
Vulnerability summary
CVE-2024-1442 is a high (CVSS 8.8) Improper Privilege Management vulnerability in grafana. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56.2% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
0.80%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 07-03-2024PublishedVulnerability first disclosed.
- 22-11-2024Last modifiedVulnerability information updated.
Description
A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.0Preferred score · OSV · Go (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:NSourcesSingle source
High 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources5 sources · 6.0–8.8
- CVE.orgCNA6.0MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated6.0MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated6.0MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:LDiffers
EPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.80% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- grafana-fips-11.6All versions (No fix recorded)
- grafana-fips-12.0< 12.0.10-r6
- grafana-fips-12.1< 12.1.10.01-r3
- grafana-fips-12.2All versions (No fix recorded)
- grafana-fips-12.3All versions (No fix recorded)
Github.com/grafana1 product
- grafana≥ 8.5.0, < 9.5.7 | ≥ 10.0.0, < 10.0.12 | ≥ 10.1.0, < 10.1.8 | ≥ 10.2.0, < 10.2.5 | ≥ 10.3.0, < 10.3.4 | All versions (No fix recorded)
Grafana1 product
- grafana≥ 8.5.0, < 9.5.7 | ≥ 10.0.0, < 10.0.12 | ≥ 10.1.0, < 10.1.8 | ≥ 10.2.0, < 10.2.5 | ≥ 10.3.0, < 10.3.4
Ubuntu1 product
- grafanaAll versions (No fix recorded)
4 vendors · 11 products
References
10 links
- github.com/grafana/grafanaPACKAGE