CVE-2024-8975

HIGH

Grafana Alloy < 1.3.3 and 1.4.0-rc.0-1.4.0-rc.1 - Privilege Escalation via Unquoted Search Path

Title source: llm

Description

Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.

References (4)

Core 4

Core References

Release Notes

https://github.com/grafana/alloy/releases/tag/v1.3.4

Release Notes

https://github.com/grafana/alloy/releases/tag/v1.4.1

Vendor Advisory

https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996/

Vendor Advisory

https://grafana.com/security/security-advisories/cve-2024-8975/

Scores

CVSS v3 7.3

EPSS 0.0030

EPSS Percentile 21.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-428

Status published

Products (3)

grafana/alloy 1.4.0 rc0 (2 CPE variants)

grafana/alloy < 1.3.3

grafana/alloy 0 - 1.3.4Go

Published Sep 25, 2024

Tracked Since Feb 18, 2026