CVE-2024-8118 Grafana alerting wrong permission on datasource rule write endpoint
Users with external alert instance write permissions can improperly modify alert rules due to incorrect API endpoint authorization checks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-8118?
CVE-2024-8118 is a medium-severity missing authorization vulnerability in Grafana, published on 26 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.
Weakness: CWE-653
Which versions are affected by CVE-2024-8118?
1 open source package ship an affected version, including grafana.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 8.5.0 | 10.4.9, 11.2.1 |
How do I fix CVE-2024-8118?
Upgrade grafana to a fixed version for your release line: 10.4.9 or 11.2.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-8118 being exploited?
There is no known exploitation of CVE-2024-8118 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as BIT-grafana-2024-8118, GHSA-3j8x-8x9q-3m4r, UBUNTU-CVE-2024-8118.