4.4
Moyenne
CVE-2024-6322 Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user…
Description
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| grafana 11.1 | 11.1.0 → < 11.1.3 | 11.1.1 |
| Grafana Enterprise 11.1 | 11.1.0 → < 11.1.3 | 11.1.1 |
Autres CVE de grafana
Les 59 CVE de grafana →
CVE-2026-27879
A resample query can be used to trigger out-of-memory crashes in Grafana
6.5
Moyenne
CVE-2026-28375
A testdata data-source can be used to trigger out-of-memory crashes in Grafana
6.5
Moyenne
CVE-2026-27876
RCE on Grafana via sqlExpressions
9.1
Critique
CVE-2026-27880
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory…
7.5
Élevée