CVE-2024-1442: Grafana's users with permissions to create a data source can CRUD all data sources

March 7, 2024 (updated November 22, 2024)

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

References

github.com/advisories/GHSA-5mxf-42f5-j782
github.com/grafana/grafana
grafana.com/security/security-advisories/cve-2024-1442
nvd.nist.gov/vuln/detail/CVE-2024-1442
security.netapp.com/advisory/ntap-20241122-0007

Code Behaviors & Features

Detect and mitigate CVE-2024-1442 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →