GHSA-q99m-qcv4-fpm7

Source

https://github.com/advisories/GHSA-q99m-qcv4-fpm7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-q99m-qcv4-fpm7/GHSA-q99m-qcv4-fpm7.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-q99m-qcv4-fpm7

Aliases

Related

Published

2024-10-18T06:30:32Z

Modified

2025-03-14T20:26:23Z

Severity

9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Grafana Command Injection And Local File Inclusion Via Sql Expressions

Details

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The duckdb binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

Database specific

{
    "nvd_published_at": "2024-10-18T04:15:04Z",
    "cwe_ids": [
        "CWE-77",
        "CWE-94"
    ],
    "severity": "CRITICAL",
    "github_reviewed_at": "2024-10-25T14:13:42Z",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/grafana/grafana

Package

Name: github.com/grafana/grafana; View open source insights on deps.dev
Purl: pkg:golang/github.com/grafana/grafana

Affected ranges

Type: SEMVER
Events: Introduced

11.0.0

Fixed

11.0.6+security-01

Database specific

last_known_affected_version_range

"<= 11.0.6"

Go / github.com/grafana/grafana

Package

Name: github.com/grafana/grafana; View open source insights on deps.dev
Purl: pkg:golang/github.com/grafana/grafana

Affected ranges

Type: SEMVER
Events: Introduced

11.1.0

Fixed

11.1.7+security-01

Database specific

last_known_affected_version_range

"<= 11.1.7"

Go / github.com/grafana/grafana

Package

Name: github.com/grafana/grafana; View open source insights on deps.dev
Purl: pkg:golang/github.com/grafana/grafana

Affected ranges

Type: SEMVER
Events: Introduced

11.2.0

Fixed

11.2.2+security-01

Database specific

last_known_affected_version_range

"<= 11.2.2"