Excessive privileges In github.com/grafana/grafana
Description
Grafana's users with permissions to create a data source can CRUD all data sources A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 9.5.7, 10.0.12, 10.1.8, 10.2.5, 10.3.4 |
Aliases
1. 2. 3. 4.
References
1. 2.