CVE-2024-8118: Grafana alerting wrong permission on datasource rule write endpoint
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/grafanato a version that resolves this vulnerability.Fixed in 11.0.6-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8118?
The severity of CVE-2024-8118 is classified as high due to improper permission settings in Grafana.
How do I fix CVE-2024-8118?
To fix CVE-2024-8118, update to the latest version of Grafana where the permission issue is resolved.
Which versions of Grafana are affected by CVE-2024-8118?
CVE-2024-8118 affects various versions of Grafana, including both OSS and Enterprise editions.
Who is impacted by CVE-2024-8118?
Users with permissions to write external alert instances in Grafana are impacted by CVE-2024-8118.
What are the potential risks of CVE-2024-8118?
The potential risks of CVE-2024-8118 include unauthorized access to modify alert rules, which could lead to misconfigured alerts and security issues.