En bref
- CVE-2024-9264 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant github.com/grafana/grafana, grafana (grafana).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 97.6%, plus élevée que 99.9% des vulnérabilités.
- Correctif : mettre à jour vers 11.0.6+security-01, 11.1.7+security-01, 11.2.2+security-01 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| github.com/grafana/grafana Go | ≥ 11.0.0, < 11.0.6+security-01≥ 11.1.0, < 11.1.7+security-01≥ 11.2.0, < 11.2.2+security-01all versions
| 11.0.6+security-0111.1.7+security-0111.2.2+security-01
|
| grafana | = 11.0.0
| No fix yet |
Description
The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The duckdb binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
NVD description
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
Autres vulnérabilités de github.com/grafana/grafana
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free