CVE Vulnerabilities

CVE-2024-1442

Improper Privilege Management

Published: Mar 07, 2024 | Modified: Nov 22, 2024
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
6 MODERATE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Ubuntu
MEDIUM

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-cli-rhel9:v2.12.0-17 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-cluster-permission-rhel9:v2.12.0-13 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-governance-policy-addon-controller-rhel9:v2.12.0-27 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-governance-policy-framework-addon-rhel9:v2.12.0-20 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-grafana-rhel9:v2.12.0-17 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-multicluster-observability-addon-rhel9:v2.12.0-20 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-must-gather-rhel9:v2.12.0-35 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-operator-bundle:v2.12.0-114 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-prometheus-config-reloader-rhel9:v2.12.0-16 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-prometheus-rhel9:v2.12.0-16 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-search-indexer-rhel9:v2.12.0-12 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-search-v2-api-rhel9:v2.12.0-15 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-search-v2-rhel9:v2.12.0-13 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-siteconfig-rhel9:v2.12.0-24 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/acm-volsync-addon-controller-rhel9:v2.12.0-22 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/cert-policy-controller-rhel9:v2.12.0-22 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/cluster-backup-rhel9-operator:v2.12.0-37 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/config-policy-controller-rhel9:v2.12.0-31 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/console-rhel9:v2.12.0-68 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/endpoint-monitoring-rhel9-operator:v2.12.0-39 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/governance-policy-propagator-rhel9:v2.12.0-29 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/grafana-dashboard-loader-rhel9:v2.12.0-39 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/insights-client-rhel9:v2.12.0-18 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/insights-metrics-rhel9:v2.12.0-18 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/klusterlet-addon-controller-rhel9:v2.12.0-12 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/kube-rbac-proxy-rhel9:v2.12.0-13 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/kube-state-metrics-rhel9:v2.12.0-17 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/memcached-exporter-rhel9:v2.12.0-10 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/memcached-rhel9:v2.12.0-7 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/metrics-collector-rhel9:v2.12.0-39 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multicloud-integrations-rhel9:v2.12.0-12 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multiclusterhub-rhel9:v2.12.0-51 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multicluster-observability-rhel9-operator:v2.12.0-39 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multicluster-operators-application-rhel9:v2.12.0-14 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multicluster-operators-channel-rhel9:v2.12.0-12 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/multicluster-operators-subscription-rhel9:v2.12.0-24 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/node-exporter-rhel9:v2.12.0-10 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/observatorium-rhel9:v2.12.0-16 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/observatorium-rhel9-operator:v2.12.0-17 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/prometheus-alertmanager-rhel9:v2.12.0-12 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/prometheus-rhel9:v2.12.0-14 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/rbac-query-proxy-rhel9:v2.12.0-39 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/search-collector-rhel9:v2.12.0-21 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/submariner-addon-rhel9:v2.12.0-24 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/thanos-receive-controller-rhel9:v2.12.0-13 *
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 RedHat rhacm2/thanos-rhel9:v2.12.0-18 *
Red Hat Ceph Storage 6.1 RedHat rhceph/rhceph-6-dashboard-rhel9:6-90 *

Potential Mitigations

References