GHSA-5mxf-42f5-j782
Grafana's users with permissions to create a data source can CRUD all data sources
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/grafana/grafana | >= 8.5.0, < 9.5.7 | 9.5.7 |
| Go | github.com/grafana/grafana | >= 10.0.0, < 10.0.12 | 10.0.12 |
| Go | github.com/grafana/grafana | >= 10.1.0, < 10.1.8 | 10.1.8 |
| Go | github.com/grafana/grafana | >= 10.2.0, < 10.2.5 | 10.2.5 |
| Go | github.com/grafana/grafana | >= 10.3.0, < 10.3.4 | 10.3.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.
Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
References
External links from the advisory. They lead to third-party sites.