CVE-2024-8118CWE-653

Grafana alerting wrong permission on datasource rule write endpoint

Medium · published September 26, 2024

CVSS v4.0
5.1
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00583 · 47.2th percentile
Weakness
CWE-653 · Improper Isolation or Compartmentalization
Published
2024-09-26T18:46Z
EPSS history
Timeline
  • 26 SEP 18:46Z
    Grafana alerting wrong permission on datasource rule write endpoint
    cvelistv5