VDB
CVE-2024-6322
CVE-2024-6322
PUBLISHED
CVSS 4.400000095367432 MEDIUM
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
EPSS 0.30% · 23.1th percentile
Risk Scores
CVSS 3.1
4.400000095367432
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
EPSS Score
0.30%
23.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | grafana | 11.1.0 |
| Bitnami | grafana | 11.1.0 |
Timeline
- Aug 20, 2024 CVE Published
- Aug 20, 2024 PoC Published
- Aug 21, 2024 EPSS Score
- Sep 11, 2024 EPSS Score
- Oct 2, 2024 EPSS Score
- Oct 5, 2024 Coalition ESS Score
- Oct 24, 2024 EPSS Score
- Nov 14, 2024 EPSS Score
- Dec 6, 2024 EPSS Score
- Dec 27, 2024 EPSS Score
- Jan 18, 2025 EPSS Score
- Feb 8, 2025 EPSS Score