CVE-2024-9264
CVSS V2 None
CVSS V3 None
Description
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
Overview
- CVE ID
- CVE-2024-9264
- Assigner
- GRAFANA
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-10-18T03:20:52.489Z
- Last Modified Date
- 2024-10-18T03:20:52.489Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://grafana.com/security/security-advisories/cve-2024-9264/ |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-9264 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9264 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-10-18 13:41:57 | Added to TrackCVE |