CVE-2024-6322
published 2024-08-20CVE-2024-6322: Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted…
PriorityP428medium5.4CVSS 3.1
AVNACHPRNUINSCCNILAL
EPSS
0.30%
22.1th percentile
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | grafana_grafana | >= 0.0.0-20240521130516-0072e4a92d89 < 0.0.0-20240725142242-c326d865c58b | 0.0.0-20240725142242-c326d865c58b |
| github.com | grafana_grafana | >= 1.9.2-0.20240521130516-0072e4a92d89 < 1.9.2-0.20240725142242-c326d865c58b | 1.9.2-0.20240725142242-c326d865c58b |
| github.com | grafana_grafana | >= 11.1.0 < 11.1.1 | 11.1.1 |
| github.com | grafana_grafana | >= 11.1.2 < 11.1.3 | 11.1.3 |
| grafana | grafana | >= 11.1.0 < 11.1.1 | 11.1.1 |
| grafana | grafana | >= 11.1.2 < 11.1.3 | 11.1.3 |
| grafana | grafana_enterprise | >= 11.1.0 < 11.1.1 | 11.1.1 |
| grafana | grafana_enterprise | >= 11.1.2 < 11.1.3 | 11.1.3 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
osv5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana
osv·2024-08-22
CVE-2024-6322 Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana
Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana
Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/grafana/grafana from v11.1.0 before v11.1.1, from v11.1.2 before v11.1.3.
GHSA
Grafana plugin data sources vulnerable to access control bypass
ghsa·2024-08-20
CVE-2024-6322 [MEDIUM] CWE-266 Grafana plugin data sources vulnerable to access control bypass
Grafana plugin data sources vulnerable to access control bypass
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
OSV
Grafana plugin data sources vulnerable to access control bypass
osv·2024-08-20
CVE-2024-6322 [MEDIUM] Grafana plugin data sources vulnerable to access control bypass
Grafana plugin data sources vulnerable to access control bypass
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
OSV
CVE-2024-6322: Access control for plugin data sources protected by the ReqActions json field of the plugin
osv·2024-08-20·CVSS 5.4
CVE-2024-6322 [MEDIUM] CVE-2024-6322: Access control for plugin data sources protected by the ReqActions json field of the plugin
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-08-20
Published