CVE Vulnerabilities

CVE-2024-1442

Improper Privilege Management

Published: Mar 07, 2024 | Modified: Mar 11, 2025
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
6 MODERATE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Ubuntu
MEDIUM

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Grafana Grafana 8.5.0 (including) 9.5.7 (excluding)
Grafana Grafana 10.0.0 (including) 10.0.12 (excluding)
Grafana Grafana 10.1.0 (including) 10.1.8 (excluding)
Grafana Grafana 10.2.0 (including) 10.2.5 (excluding)
Grafana Grafana 10.3.0 (including) 10.3.4 (excluding)
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-cli-rhel9:v2.12.0-17 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-cluster-permission-rhel9:v2.12.0-13 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-governance-policy-addon-controller-rhel9:v2.12.0-27 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-governance-policy-framework-addon-rhel9:v2.12.0-20 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-grafana-rhel9:v2.12.0-17 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-multicluster-observability-addon-rhel9:v2.12.0-20 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-must-gather-rhel9:v2.12.0-35 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-operator-bundle:v2.12.0-114 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-prometheus-config-reloader-rhel9:v2.12.0-16 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-prometheus-rhel9:v2.12.0-16 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-search-indexer-rhel9:v2.12.0-12 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-search-v2-api-rhel9:v2.12.0-15 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-search-v2-rhel9:v2.12.0-13 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-siteconfig-rhel9:v2.12.0-24 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-volsync-addon-controller-rhel9:v2.12.0-22 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/cert-policy-controller-rhel9:v2.12.0-22 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/cluster-backup-rhel9-operator:v2.12.0-37 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/config-policy-controller-rhel9:v2.12.0-31 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/console-rhel9:v2.12.0-68 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/endpoint-monitoring-rhel9-operator:v2.12.0-39 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/governance-policy-propagator-rhel9:v2.12.0-29 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/grafana-dashboard-loader-rhel9:v2.12.0-39 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/insights-client-rhel9:v2.12.0-18 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/insights-metrics-rhel9:v2.12.0-18 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/klusterlet-addon-controller-rhel9:v2.12.0-12 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/kube-rbac-proxy-rhel9:v2.12.0-13 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/kube-state-metrics-rhel9:v2.12.0-17 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/memcached-exporter-rhel9:v2.12.0-10 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/memcached-rhel9:v2.12.0-7 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/metrics-collector-rhel9:v2.12.0-39 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multicloud-integrations-rhel9:v2.12.0-12 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multiclusterhub-rhel9:v2.12.0-51 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multicluster-observability-rhel9-operator:v2.12.0-39 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multicluster-operators-application-rhel9:v2.12.0-14 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multicluster-operators-channel-rhel9:v2.12.0-12 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multicluster-operators-subscription-rhel9:v2.12.0-24 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/node-exporter-rhel9:v2.12.0-10 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/observatorium-rhel9:v2.12.0-16 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/observatorium-rhel9-operator:v2.12.0-17 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/prometheus-alertmanager-rhel9:v2.12.0-12 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/prometheus-rhel9:v2.12.0-14 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/rbac-query-proxy-rhel9:v2.12.0-39 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/search-collector-rhel9:v2.12.0-21 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/submariner-addon-rhel9:v2.12.0-24 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/thanos-receive-controller-rhel9:v2.12.0-13 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/thanos-rhel9:v2.12.0-18 *
Red Hat Ceph Storage 6.1 RedHat rhceph/rhceph-6-dashboard-rhel9:6-90 *

Potential Mitigations

References