rpm package
opensuse/grafana&distro=openSUSE Leap 15.6
pkg:rpm/opensuse/grafana&distro=openSUSE%20Leap%2015.6
Vulnerabilities (29)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-45337 | Cri | 9.1 | < 10.4.13-150200.3.59.1 | 10.4.13-150200.3.59.1 | Dec 12, 2024 | Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that | |
| CVE-2024-9476 | Med | — | < 11.5.5-150200.3.72.2 | 11.5.5-150200.3.72.2 | Nov 13, 2024 | A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utiliz | |
| CVE-2024-9264 | — | < 11.5.5-150200.3.72.2 | 11.5.5-150200.3.72.2 | Oct 18, 2024 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user wit | ||
| CVE-2024-8118 | Med | — | < 10.4.13-150200.3.59.1 | 10.4.13-150200.3.59.1 | Sep 26, 2024 | In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules. | |
| CVE-2023-45288 | Hig | 7.5 | < 11.5.5-150200.3.72.2 | 11.5.5-150200.3.72.2 | Apr 4, 2024 | An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed Ma | |
| CVE-2024-1313 | Med | 6.5 | < 9.5.18-150200.3.56.1 | 9.5.18-150200.3.56.1 | Mar 26, 2024 | It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the per | |
| CVE-2024-28180 | — | < 10.4.15-150200.3.64.1 | 10.4.15-150200.3.64.1 | Mar 9, 2024 | Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now ret | ||
| CVE-2023-6152 | — | < 9.5.18-150200.3.56.1 | 9.5.18-150200.3.56.1 | Feb 13, 2024 | A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. | ||
| CVE-2023-3128 | — | < 10.4.13-150200.3.59.1 | 10.4.13-150200.3.59.1 | Jun 22, 2023 | Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app. |
- affected < 10.4.13-150200.3.59.1fixed 10.4.13-150200.3.59.1
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that
- affected < 11.5.5-150200.3.72.2fixed 11.5.5-150200.3.72.2
A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utiliz
- CVE-2024-9264Oct 18, 2024affected < 11.5.5-150200.3.72.2fixed 11.5.5-150200.3.72.2
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user wit
- affected < 10.4.13-150200.3.59.1fixed 10.4.13-150200.3.59.1
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.
- affected < 11.5.5-150200.3.72.2fixed 11.5.5-150200.3.72.2
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed Ma
- affected < 9.5.18-150200.3.56.1fixed 9.5.18-150200.3.56.1
It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the per
- CVE-2024-28180Mar 9, 2024affected < 10.4.15-150200.3.64.1fixed 10.4.15-150200.3.64.1
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now ret
- CVE-2023-6152Feb 13, 2024affected < 9.5.18-150200.3.56.1fixed 9.5.18-150200.3.56.1
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.
- CVE-2023-3128Jun 22, 2023affected < 10.4.13-150200.3.59.1fixed 10.4.13-150200.3.59.1
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
Page 2 of 2