{"id":"CVE-2024-1442","published":"2024-03-07T17:45:43Z","modified":"2024-11-22T12:04:45Z","title":"User with permissions to create a data source can CRUD all data sources","vendor":"Grafana","product":"Grafana","tier":"tail","description":{"text":" A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.\nDoing this will grant the user access to read, query, edit and delete all data sources within the organization.\n","provenance":"source","from":"CVE.org"},"cvss":{"score":6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00802,"percentile":0.5653,"provenance":"source"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2024-1442/","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20241122-0007/","tags":[]}],"priority":{"score":15.5,"factors":[{"name":"EPSS percentile","points":11.31},{"name":"CVSS severity","points":4.2}]},"vendorSlug":"grafana","affectedVersions":[{"vendor":"Grafana","product":"Grafana","versions":[">= 8.5.0, < 9.5.7",">= 10.0.0, < 10.0.12",">= 10.1.0, < 10.1.8",">= 10.2.0, < 10.2.5",">= 10.3.0, < 10.3.4"]}],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=8.5.0, <9.5.7",">=10.0.0, <10.0.12",">=10.1.0, <10.1.8",">=10.2.0, <10.2.5",">=10.3.0, <10.3.4","all versions"],"patched":["9.5.7","10.0.12","10.1.8","10.2.5","10.3.4"],"from":["GHSA-5mxf-42f5-j782","GO-2024-2629"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0834","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2023-2183","published":"2023-06-06","fixed":"9.5.3","kev":false},{"cve":"CVE-2023-2801","published":"2023-06-06","fixed":"9.5.3","kev":false,"link":{"from":"CVE-2023-2801","to":"CVE-2024-1442","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"9.5.3","toFixed":"9.5.7","daysApart":275}]}},{"cve":"CVE-2023-6152","published":"2024-02-13","fixed":"10.3.3","kev":false,"link":{"from":"CVE-2023-6152","to":"CVE-2024-1442","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"10.0.11","toFixed":"10.0.12","daysApart":23}]}},{"cve":"CVE-2024-1442","published":"2024-03-07","fixed":"10.3.4","kev":false},{"cve":"CVE-2024-1313","published":"2024-03-26","fixed":"10.3.5","kev":false,"link":{"from":"CVE-2024-1442","to":"CVE-2024-1313","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"10.0.12","toFixed":"10.0.13","daysApart":19}]}},{"cve":"CVE-2024-6322","published":"2024-08-20","fixed":"11.1.3","kev":false},{"cve":"CVE-2024-9264","published":"2024-10-18","fixed":"11.2.2+security-01","kev":false}],"package":"Go:github.com/grafana/grafana"}}