CVE-2024-8118: Grafana alerting wrong permission on datasource rule write endpoint
Published Sep 26, 2024
·Updated
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.
Affected Software
1 affected component
Grafana Grafana
Event History
Sep 26, 2024
CVE Published
via MITRE·06:46 PM
Data Sourced
via MITRE·06:46 PM
DescriptionWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-8118?
The severity of CVE-2024-8118 is classified as high due to improper permission settings in Grafana.
2
How do I fix CVE-2024-8118?
To fix CVE-2024-8118, update to the latest version of Grafana where the permission issue is resolved.
3
Which versions of Grafana are affected by CVE-2024-8118?
CVE-2024-8118 affects various versions of Grafana, including both OSS and Enterprise editions.
4
Who is impacted by CVE-2024-8118?
Users with permissions to write external alert instances in Grafana are impacted by CVE-2024-8118.
5
What are the potential risks of CVE-2024-8118?
The potential risks of CVE-2024-8118 include unauthorized access to modify alert rules, which could lead to misconfigured alerts and security issues.