VulnerabilityDeferred

CVE-2024-8118

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

MEDIUM 5.1EPSS 0.58%

Does this matter?

Lower severity and a low EPSS score (0.58%). Track it; it rarely justifies an emergency change on its own.

Description

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.58% probability · 46th percentile
CISA KEV: Not listed
Weakness: CWE-653
Source: security@grafana.com

References

https://grafana.com/security/security-advisories/cve-2024-8118/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.