En resumen
- CVE-2024-9264 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a github.com/grafana/grafana, grafana (grafana).
- Probabilidad de explotación en los próximos 30 días (EPSS): 97.6%, mayor que el 99.9% de las vulnerabilidades.
- Solución: actualizar a 11.0.6+security-01, 11.1.7+security-01, 11.2.2+security-01 o posterior.
| Package | Affected versions | Patched versions |
|---|
| github.com/grafana/grafana Go | ≥ 11.0.0, < 11.0.6+security-01≥ 11.1.0, < 11.1.7+security-01≥ 11.2.0, < 11.2.2+security-01all versions
| 11.0.6+security-0111.1.7+security-0111.2.2+security-01
|
| grafana | = 11.0.0
| No fix yet |
Description
The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The duckdb binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
NVD description
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
Más vulnerabilidades de github.com/grafana/grafana
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free