CVE-2024-1442CWE-269

User with permissions to create a data source can CRUD all data sources

Medium · published March 7, 2024

CVSS v3.1
6.0
EPSS
1%
Percentile
56.2
In the wild
Unconfirmed
What it is

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.

Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00802 · 56.2th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2024-03-07T17:45Z
EPSS history
Timeline
  • 07 MAR 17:45Z
    User with permissions to create a data source can CRUD all data sources
    cvelistv5