BIT-grafana-2024-8118

vendorUSosv

Grafana alerting wrong permission on datasource rule write endpoint

view advisory published 2025-04-14Licence: per source

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-8118US	—	0.58% (48th)	Exploit	2024-09-26
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

references

External citations — patches, advisories, analysis.

https://grafana.com/security/security-advisories/cve-2024-8118/WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-8118WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan