| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| github.com/grafana/grafana | < 1.9.2-0.20260127141016-e702db6096e0mọi phiên bản | 1.9.2-0.20260127141016-e702db6096e0 |
| grafana | ≥ 12.0.0, < 12.0.9≥ 12.1.0, < 12.1.6≥ 12.2.0, < 12.2.4≥ 12.3.0, < 12.3.3< 11.6.11 | 12.0.912.1.612.2.412.3.311.6.11 |
hero: image: /static/img/heros/hero-legal2.svg content: "# Cross-Tenant Legacy Correlation Disclosure and Deletion" date: 2026-01-29 product: Grafana fixed_versions:
A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.
Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí