It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability. This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.
Priority: --
CVSS v3: 6.5
Component:
Publish Date: Mar 26, 2024
Related ID: --
CVSS v2: MEDIUM
Modified Date: Mar 26, 2024
Find out more about CVE-2024-1313 from the MITRE-CVE dictionary and NIST NVD
Login may be required to access defects or downloads.
| Product Name |
Status |
Defect |
Fixed |
Downloads |
| Linux |
| Wind River Linux LTS 17 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux 8 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux 9 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux 7 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux LTS 21 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux LTS 22 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux LTS 18 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux LTS 19 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux CD release |
N/A |
-- |
-- |
-- |
| Wind River Linux 6 |
Not Vulnerable |
-- |
-- |
-- |
| Wind River Linux LTS 23 |
Not Vulnerable |
-- |
-- |
-- |
| VxWorks |
| VxWorks 7 |
Not Vulnerable |
-- |
-- |
-- |
| VxWorks 6.9 |
Not Vulnerable |
-- |
-- |
-- |
| Helix Virtualization Platform Cert Edition |
| Helix Virtualization Platform Cert Edition |
Not Vulnerable |
-- |
-- |
-- |
| Product Name |
Status |
Defect |
Fixed |
Downloads |
Notes
Requires LTSS - customers must have active LTSS (Long Term Security Shield) Support to receive up-to-date information about vulnerabilities that may affect legacy software. Please contact your Wind River account team or see https://docs.windriver.com/bundle/Support_and_Maintenance_Supplemental_Terms_and_Conditions and https://support2.windriver.com/index.php?page=plc for more information.
