{"answers":{"affected":"1 open source package ship an affected version, including grafana.","exploited":"There is no known exploitation of CVE-2024-8118 in the wild and no public exploit code.","fix":"Upgrade grafana to a fixed version for your release line: 10.4.9 or 11.2.1.","what":"CVE-2024-8118 is a medium-severity missing authorization vulnerability in Grafana, published on 26 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-8118 and fix it if it is affected.\n\nWhat it is: CVE-2024-8118 is a medium-severity missing authorization vulnerability in Grafana, published on 26 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-8118 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- grafana (Bitnami): affected from 8.5.0; fixed in 10.4.9, 11.2.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-8118/ (Markdown: https://insights.sbomify.com/CVE-2024-8118/index.md)","id":"CVE-2024-8118","markdown":"https://insights.sbomify.com/CVE-2024-8118/index.md","name":"CVE-2024-8118","record":{"aliases":["BIT-grafana-2024-8118","GHSA-3j8x-8x9q-3m4r","UBUNTU-CVE-2024-8118"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Grafana monitoring platform","requires_auth":"high_privilege","summary":"Users with external alert instance write permissions can improperly modify alert rules due to incorrect API endpoint authorization checks.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GRAFANA","cpe":[],"cvss":{"score":5.1,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-653","name":"Improper Isolation or Compartmentalization"}],"description":"In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.","ecosystems":["Bitnami"],"exploits":{"exploitdb":0,"first_seen":"2025-07-21","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2025-07-21T05:58:31Z","kind":"github_poc","ref":"https://github.com/nurarifin05/POC-CVE-2024-8118","stars":0,"title":"Berikut untuk POC grafana CVE-2024-8118 "}],"tier":"poc_unverified"},"has_fix":true,"headline":"Grafana alerting wrong permission on datasource rule write endpoint","id":"CVE-2024-8118","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"missing_authorization","year":"2024"},"n_packages":1,"n_references":1,"next":{"headline":"The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.8 - Reflected Cross-Site Scripting via page","id":"CVE-2024-8119"},"packages":[{"ecosystem":"Bitnami","fixed":["10.4.9","11.2.1"],"introduced":["8.5.0","11.0.0"],"last_affected":[],"package":"grafana","purl":"pkg:bitnami/grafana","source":"BIT-grafana-2024-8118"}],"prev":{"headline":"The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.8 - Reflected Cross-Site Scripting via selected_option","id":"CVE-2024-8117"},"products":["Grafana"],"published":"2024-09-26","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-09-26","vendors":["Grafana"]},"summary":"Users with external alert instance write permissions can improperly modify alert rules due to incorrect API endpoint authorization checks.","url":"https://insights.sbomify.com/CVE-2024-8118/"}