Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a CVE vulnerability ID? 
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
New vulnerability? Tell us about it!
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2024-6322
Good to know:
Date: August 20, 2024
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
Language: Go
Severity Score
Related Resources (8)
Severity Score
Weakness Type (CWE)
Incorrect Privilege Assignment
CWE-266Top Fix
Upgrade Version
Upgrade to version github.com/grafana/grafana - v11.1.1;github.com/grafana/grafana - v11.1.3;github.com/grafana/grafana - v0.0.0-20240725142242-c326d865c58b;github.com/grafana/grafana - v1.9.2-0.20240725142242-c326d865c58b
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | HIGH |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | CHANGED |
| Confidentiality (C): | NONE |
| Integrity (I): | LOW |
| Availability (A): | LOW |