Vulnerability-Lookup

CVE-2024-1442 (GCVE-0-2024-1442)

Vulnerability from cvelistv5 – Published: 2024-03-07 17:45 – Updated: 2024-11-22 12:04

Title

User with permissions to create a data source can CRUD all data sources

Summary

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

Severity

6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-26 14:35 UTC

CWE

CWE-269

Assigner

GRAFANA mitre root

References

2 references

URL	Tags
https://grafana.com/security/security-advisories/…
https://security.netapp.com/advisory/ntap-2024112…

Impacted products

1 product

Vendor	Product	Version	CPE status
Grafana	Grafana	Affected: 8.5.0 , < 9.5.7 (semver) Affected: 10.0.0 , < 10.0.12 (semver) Affected: 10.1.0 , < 10.1.8 (semver) Affected: 10.2.0 , < 10.2.5 (semver) Affected: 10.3.0 , < 10.3.4 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1442",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-26T14:35:40.672183Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-26T14:35:58.049Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-11-22T12:04:45.739Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://grafana.com/security/security-advisories/cve-2024-1442/"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241122-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "9.5.7",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.0.12",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.1.8",
              "status": "affected",
              "version": "10.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.2.5",
              "status": "affected",
              "version": "10.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.3.4",
              "status": "affected",
              "version": "10.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": " A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.\u003cbr\u003eDoing this will grant the user access to read, query, edit and delete all data sources within the organization.\u003cbr\u003e"
            }
          ],
          "value": " A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.\nDoing this will grant the user access to read, query, edit and delete all data sources within the organization.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-07T17:45:43.993Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "url": "https://grafana.com/security/security-advisories/cve-2024-1442/"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "User with permissions to create a data source can CRUD all data sources",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2024-1442",
    "datePublished": "2024-03-07T17:45:43.993Z",
    "dateReserved": "2024-02-12T12:21:26.806Z",
    "dateUpdated": "2024-11-22T12:04:45.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-1442",
      "date": "2026-09-16",
      "epss": "0.00802",
      "percentile": "0.54875"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \" A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.\\nDoing this will grant the user access to read, query, edit and delete all data sources within the organization.\\n\"}, {\"lang\": \"es\", \"value\": \"Un usuario con permisos para crear una fuente de datos puede usar Grafana API para crear una fuente de datos con UID configurado en *. Hacer esto le otorgar\\u00e1 al usuario acceso para leer, consultar, editar y eliminar todas las fuentes de datos dentro de la organizaci\\u00f3n.\"}]",
      "id": "CVE-2024-1442",
      "lastModified": "2024-11-22T12:15:18.137",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@grafana.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L\", \"baseScore\": 6.0, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 4.7}]}",
      "published": "2024-03-07T18:15:46.590",
      "references": "[{\"url\": \"https://grafana.com/security/security-advisories/cve-2024-1442/\", \"source\": \"security@grafana.com\"}, {\"url\": \"https://grafana.com/security/security-advisories/cve-2024-1442/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20241122-0007/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@grafana.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security@grafana.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-269\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-1442\",\"sourceIdentifier\":\"security@grafana.com\",\"published\":\"2024-03-07T18:15:46.590\",\"lastModified\":\"2026-06-17T07:04:15.300\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\" A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.\\nDoing this will grant the user access to read, query, edit and delete all data sources within the organization.\\n\"},{\"lang\":\"es\",\"value\":\"Un usuario con permisos para crear una fuente de datos puede usar Grafana API para crear una fuente de datos con UID configurado en *. Hacer esto le otorgar\u00e1 al usuario acceso para leer, consultar, editar y eliminar todas las fuentes de datos dentro de la organizaci\u00f3n.\"}],\"affected\":[{\"source\":\"security@grafana.com\",\"affectedData\":[{\"vendor\":\"Grafana\",\"product\":\"Grafana\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"8.5.0\",\"lessThan\":\"9.5.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"10.0.0\",\"lessThan\":\"10.0.12\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"10.1.0\",\"lessThan\":\"10.1.8\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"10.2.0\",\"lessThan\":\"10.2.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"10.3.0\",\"lessThan\":\"10.3.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@grafana.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L\",\"baseScore\":6.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.2,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-07-26T14:35:40.672183Z\",\"id\":\"CVE-2024-1442\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@grafana.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-269\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.5.0\",\"versionEndExcluding\":\"9.5.7\",\"matchCriteriaId\":\"256F06F9-C861-48F9-8317-A0F0133C0FBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.0.12\",\"matchCriteriaId\":\"768ED1D5-DD09-4D2B-AD74-F5D1A03DF8D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.1.0\",\"versionEndExcluding\":\"10.1.8\",\"matchCriteriaId\":\"642B089C-E5B7-4AD4-B477-2579A8A1AB23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.2.0\",\"versionEndExcluding\":\"10.2.5\",\"matchCriteriaId\":\"FF474EF5-B4C2-4CEF-86AD-55A116C9E15F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.3.0\",\"versionEndExcluding\":\"10.3.4\",\"matchCriteriaId\":\"E4854C70-56B3-49ED-BF70-28673BD4E2D7\"}]}]}],\"references\":[{\"url\":\"https://grafana.com/security/security-advisories/cve-2024-1442/\",\"source\":\"security@grafana.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://grafana.com/security/security-advisories/cve-2024-1442/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20241122-0007/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-03-25T22:30:49+00:00",
      "cve": "CVE-2024-1442",
      "id": "CVE-2024-1442",
      "initial_release_date": "2024-03-07T00:00:00+00:00",
      "product_status:fixed": "186",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "34",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "grafana: Improper priviledge managent for users with data source permissions",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-1442.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2025-04-08T02:10:03Z",
      "cve": "CVE-2024-1442",
      "id": "CVE-2024-1442",
      "initial_release_date": "2024-03-09T03:55:46Z",
      "product_status:known_not_affected": "10",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-1442",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-1442.json",
      "version": "8"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://grafana.com/security/security-advisories/cve-2024-1442/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20241122-0007/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-11-22T12:04:45.739Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-1442\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-26T14:35:40.672183Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-26T14:35:55.777Z\"}}], \"cna\": {\"title\": \"User with permissions to create a data source can CRUD all data sources\", \"source\": {\"discovery\": \"INTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-233\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-233 Privilege Escalation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Grafana\", \"product\": \"Grafana\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.5.0\", \"lessThan\": \"9.5.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"10.0.12\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"10.1.0\", \"lessThan\": \"10.1.8\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"10.2.0\", \"lessThan\": \"10.2.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"10.3.0\", \"lessThan\": \"10.3.4\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://grafana.com/security/security-advisories/cve-2024-1442/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \" A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.\\nDoing this will grant the user access to read, query, edit and delete all data sources within the organization.\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \" A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.\u003cbr\u003eDoing this will grant the user access to read, query, edit and delete all data sources within the organization.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-269\", \"description\": \"CWE-269\"}]}], \"providerMetadata\": {\"orgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"shortName\": \"GRAFANA\", \"dateUpdated\": \"2024-03-07T17:45:43.993Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-1442\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-22T12:04:45.739Z\", \"dateReserved\": \"2024-02-12T12:21:26.806Z\", \"assignerOrgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"datePublished\": \"2024-03-07T17:45:43.993Z\", \"assignerShortName\": \"GRAFANA\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

RHSA-2024_2633

Vulnerability from csaf_redhat - Published: 2024-05-01 01:17 - Updated: 2024-12-17 17:33

Summary

Red Hat Security Advisory: updated rhceph-6.1 container image

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2024-1442.

CVE-2024-1442

A flaw was found in Grafana, where setting the Grafana API Data Source UID to '*' Grants Unrestricted Access, grants a user the ability to set the UID to '*' via the Grafana API poses a severe security risk. This issue enables unauthorized access to read, query, edit, and delete all data sources within the organization. Such unrestricted access can lead to data breaches, manipulation, privacy violations, and compliance issues, emphasizing the critical importance of implementing stringent access controls and monitoring API usage.

6.0 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

Fixed: 3 products Known not affected: 15 products

https://access.redhat.com/errata/RHSA-2024:2633

Open the full advisory

RHSA-2024_8974

Vulnerability from csaf_redhat - Published: 2024-11-06 20:13 - Updated: 2024-12-17 22:52

Summary

Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.12.0 security and bug fixes

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2024-1442.

CVE-2024-1442

6.0 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

Fixed: 183 products

https://access.redhat.com/errata/RHSA-2024:8974

Open the full advisory

ubuntu-cve-2024-1442

Vulnerability from osv_ubuntu

Published

2024-03-07 18:15

Modified

2025-10-24 05:06

Summary

Details

Severity

6.0 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-1442	REPORT
	https://grafana.com/security/security-advisories/…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-1442	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "grafana",
            "binary_version": "2.6.0+dfsg-1"
          },
          {
            "binary_name": "grafana-data",
            "binary_version": "2.6.0+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "grafana",
        "purl": "pkg:deb/ubuntu/grafana@2.6.0+dfsg-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.6.0+dfsg-1"
      ]
    }
  ],
  "aliases": [],
  "details": "A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.",
  "id": "UBUNTU-CVE-2024-1442",
  "modified": "2025-10-24T05:06:41Z",
  "published": "2024-03-07T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-1442"
    },
    {
      "type": "REPORT",
      "url": "https://grafana.com/security/security-advisories/cve-2024-1442/"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1442"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-1442"
  ]
}

WID-SEC-W-2024-0585

Vulnerability from csaf_certbund - Published: 2024-03-07 23:00 - Updated: 2026-04-29 22:00

Summary

Grafana: Schwachstelle ermöglicht Privilegieneskalation

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2024-1442.

CVE-2024-1442

Known affected: 8 products

Open the full advisory

WID-SEC-W-2025-0135

Vulnerability from csaf_certbund - Published: 2025-01-21 23:00 - Updated: 2025-01-21 23:00

Summary

Oracle Communications Applications: Mehrere Schwachstellen

Severity

Hoch

Scope

23 vulnerabilities in this advisory, including CVE-2024-1442.

CVE-2024-1442

In Oracle Communications Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrität und Verfügbarkeit gefährden. Für die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle veröffentlicht keine weiteren Details zu diesen Schwachstellen (außer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadenshöhe ausschließlich auf Basis der CVSS Impact Matrix. Der Maximalwert für diese Produkte ist "HIGH" für "Confidentiality", "Integrity" und "Availability" über alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert "HOCH" für die Schadenshöhe.

Known affected: 12 products Last affected: 3 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-1442 (GCVE-0-2024-1442)

RHSA-2024_2633

RHSA-2024_8974

ubuntu-cve-2024-1442

Vulnerability from osv_ubuntu

WID-SEC-W-2024-0585

WID-SEC-W-2025-0135

Tags

Sightings

Nomenclature

Related by attack behaviour