~ / search / GHSA-wxcc-2f3q-4h58

GHSA-wxcc-2f3q-4h58

Grafana Alerting VictorOps integration could be exposed to users with Viewer permission

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-11741

Packages

EcosystemPackageAffectedFixed in
Go github.com/grafana/grafana >= 11.4.0, < 11.4.1 11.4.1
Go github.com/grafana/grafana >= 11.3.0, < 11.3.3 11.3.3
Go github.com/grafana/grafana >= 11.2.0, < 11.2.6 11.2.6
Go github.com/grafana/grafana >= 11.1.0, < 11.1.11 11.1.11
Go github.com/grafana/grafana >= 11.0.0, < 11.0.11 11.0.11
Go github.com/grafana/grafana >= 1.9.2, < 10.4.15 10.4.15
Go github.com/grafana/grafana < 0.0.0-20250129224826-70073427041e 0.0.0-20250129224826-70073427041e
Go github.com/grafana/grafana >= 0.0.0, < 1.9.2-0.20250129224826-70073427041e 1.9.2-0.20250129224826-70073427041e

Details

As written in the advisory (Markdown source, shown as plain text).

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15

References

External links from the advisory. They lead to third-party sites.