5 results (0.006 seconds)

CVSS: 5.8EPSS: 0%CPEs: 5EXPL: 0

CVE-2024-8118 – Grafana alerting wrong permission on datasource rule write endpoint

https://notcve.org/view.php?id=CVE-2024-8118

26 Sep 2024 — In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules. • https://grafana.com/security/security-advisories/cve-2024-8118 • CWE-653: Improper Isolation or Compartmentalization •

CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0

CVE-2024-1313 – Users outside an organization can delete a snapshot with its key

https://notcve.org/view.php?id=CVE-2024-1313

26 Mar 2024 — It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana ... • https://grafana.com/security/security-advisories/cve-2024-1313 • CWE-639: Authorization Bypass Through User-Controlled Key •

CVSS: 7.3EPSS: 0%CPEs: 5EXPL: 0

CVE-2024-1442 – User with permissions to create a data source can CRUD all data sources

https://notcve.org/view.php?id=CVE-2024-1442

07 Mar 2024 — A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization. Un usuario con permisos para crear una fuente de datos puede usar Grafana API para crear una fuente de datos con UID configurado en *. Hacer esto le otorgará al usuario acceso para leer, consultar, editar y eliminar todas las fuentes de datos dentro de la organización. A flaw was foun... • https://grafana.com/security/security-advisories/cve-2024-1442 • CWE-269: Improper Privilege Management •

CVSS: 6.8EPSS: 0%CPEs: 10EXPL: 0

CVE-2023-6152

https://notcve.org/view.php?id=CVE-2023-6152

13 Feb 2024 — A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. Un usuario que cambia su correo electrónico después de registrarse y verificarlo puede cambiarlo sin verificación en la configuración del perfil. La opción de configuración "verify_email_enabled" solo validará el correo electrónico al registrarse. • https://github.com/grafana/bugbounty/security/advisories/GHSA-3hv4-r2fm-h27f • CWE-863: Incorrect Authorization •

CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 2

CVE-2023-34111 – Command Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanaplugin

https://notcve.org/view.php?id=CVE-2023-34111

06 Jun 2023 — The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execution within the github action context due to the insecure usage of `${{ github.event.pull_request.title }}` in a bash command within the GitHub workflow. Attackers can inject malicious commands which will be executed by the workflow. This happens because `${{ github.event.pull_request.title }}` is directly passed to bash command on like 25 of the wor... • https://github.com/taosdata/grafanaplugin/blob/master/.github/workflows/release-pr-merged.yaml#L25 • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •