CVE-2024-8118

Grafana alerting wrong permission on datasource rule write endpoint

State: Published
Severity: 5.1 Medium
Published: Sep 26, 2024
Updated: Sep 26, 2024
Reserved: Aug 23, 2024

Description

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	GRAFANA

Weaknesses

CWE-653 Improper Isolation or Compartmentalization

Affected Products

Product	Versions
GrafanaGrafana	8.5.0 to before 10.3.10Affected 10.4.0 to before 10.4.9Affected 11.0.0 to before 11.0.5Affected 11.1.0 to before 11.1.6Affected 11.2.0 to before 11.2.1Affected

References

https://grafana.com/security/security-advisories/cve-2024-8118/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.