CVE-2024-6322 json
Grafana plugin data sources vulnerable to access control bypass
published 2024-08-20 2 y ago modified 2026-09-10 1 mo ago also BIT-grafana-2024-6322 , EUVD-2024-2596 , GHSA-hh8p-374f-qgr5 , GO-2024-3079
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
Patch / fix
- go github.com/grafana/grafana 0.0.0-20240725142242-c326d865c58b, 1.9.2-0.20240725142242-c326d865c58b, 11.1.1, 11.1.3
- bitnami grafana 11.1.3
- Grafana Grafana 11.1.1, 11.1.3
- Grafana Grafana Enterprise 11.1.1, 11.1.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L |
| GitHub | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L |
| OSV | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/grafana/grafana | >=11.1.0, <11.1.1 >=11.1.2, <11.1.3 >=0.0.0-20240521130516-0072e4a92d89, <0.0.0-20240725142242-c326d865c58b >=1.9.2-0.20240521130516-0072e4a92d89, <1.9.2-0.20240725142242-c326d865c58b all versions |
11.1.1 11.1.3 0.0.0-20240725142242-c326d865c58b 1.9.2-0.20240725142242-c326d865c58b |
| bitnami | grafana | >=11.1.0, <11.1.3 |
11.1.3 |
Affected products
- Grafana Grafana
- Grafana Grafana Enterprise
Classification
- Weakness
-
- CWE-266 Incorrect Privilege Assignment
References
-
github.com
/grafana/grafana/commit/4cb3ba5d1a7ab8b9676034e89dada2fcde1766ef
web, patch
-
github.com
/grafana/grafana/commit/9cdba084a9100c6b11d32eef9d2bd53656c6964a
web, patch
-
grafana.com
/security/security-advisories/cve-2024-6322/
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-6322
advisory, web
-
github.com
/grafana/grafana
package
-
grafana.com
/security/security-advisories/cve-2024-6322
web
-
github.com
/advisories/GHSA-hh8p-374f-qgr5
advisory
Sources
- CVE List CVE-2024-6322
- GitHub Advisory GHSA-hh8p-374f-qgr5
- NVD CVE-2024-6322
- OSV BIT-grafana-2024-6322
- OSV GO-2024-3079
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.