Grafana's users with permissions to create a data source can CRUD all data sources

2024-03-0718:30:28

CWE-269

GitHub Advisory Database

github.com

grafana

user permissions

data sources

crud

api

organization.

6 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.
Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

Affected configurations

Vulners

Node

github_advisory_databasegithub.com\/grafana\/grafanaRange<10.3.4

github_advisory_databasegithub.com\/grafana\/grafanaRange<10.2.5

github_advisory_databasegithub.com\/grafana\/grafanaRange<10.1.8

github_advisory_databasegithub.com\/grafana\/grafanaRange<10.0.12

github_advisory_databasegithub.com\/grafana\/grafanaRange8.5.0≥

github_advisory_databasegithub.com\/grafana\/grafanaRange<9.5.7

CPENameOperatorVersion
github.com/grafana/grafanalt10.3.4
github.com/grafana/grafanalt10.2.5
github.com/grafana/grafanalt10.1.8
github.com/grafana/grafanalt10.0.12
github.com/grafana/grafanage8.5.0
github.com/grafana/grafanalt9.5.7

Name	Operator	Version
github.com/grafana/grafana	lt	10.3.4
github.com/grafana/grafana	lt	10.2.5
github.com/grafana/grafana	lt	10.1.8
github.com/grafana/grafana	lt	10.0.12
github.com/grafana/grafana	ge	8.5.0
github.com/grafana/grafana	lt	9.5.7