CVE-2024-1442

MEDIUM

Grafana 8.5.0-9.5.6 - Improper Privilege Management via Data Source UID Manipulation

Title source: llm

Description

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

References (2)

Core 2

Core References

Vendor Advisory

https://grafana.com/security/security-advisories/cve-2024-1442/

Third Party Advisory

https://security.netapp.com/advisory/ntap-20241122-0007/

Scores

CVSS v3 6.0

EPSS 0.0080

EPSS Percentile 51.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-269

Status published

Products (2)

grafana/grafana 8.5.0 - 9.5.7

grafana/grafana 8.5.0 - 9.5.7Go

Published Mar 07, 2024

Tracked Since Feb 18, 2026