Every CVE Search/ Get API key

CVE-2024-1313

Users outside an organization can delete a snapshot with its key

6.5 MediumFix available

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized.

Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability.

This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.65%Up 0.6 points since Mar 27, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.5

Users outside an organization can delete a snapshot with its key

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized.

Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability.

This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.

Record
CVE-2024-1313
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-639
Updated
2026-11-02
EUVDEUVD-2024-1120 6.5

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized.

Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability.

This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.

Record
EUVD-2024-1120
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-67rv-qpw2-6qrr 7.1

Grafana: Users outside an organization can delete a snapshot with its key

Summary

The DELETE /api/snapshots/{key} endpoint allows any Grafana user to delete snapshots if the user is NOT in the organization of the snapshot

Details

An attacker (a user without organization affiliation or with a "no basic role" in an organization other than the one where the dashboard exists), knowing the key or URL of a snapshot created by any user (including Grafana admins), can delete a snapshot (It is not feasible using UI), resulting in a BOLA vulnerability. If an attacker is in the same organization of the dashboard snapshot, he can’t delete the snapshot. However, an attacker with low-privilege from a different organization would be able to delete it, resulting in the authorization flaw.

Precondition

To exploit this endpoint, an attacker must know the {key} of a snapshot. The attacker can potentially discover this key in various ways.

When creating a snapshot through the API, users can manually specify a key without any complexity requirements. This lack of complexity makes this key susceptible to brute force attacks. For example, simplistic keys such as "customer_key_123" or "admin_snap" can be easily guessed. These predictable keys allow low-privileged attackers to perform brute-force attacks using common keywords, potentially leading to compromised data integrity.

In addition, this key is displayed in plain text in the URL of a snapshot. This means that if a user publicly displays a snapshot, viewers might note down the key. Furthermore, since the snapshot feature is often used for sharing, displaying, and backing up data, a low-privileged attacker could potentially find snapshot keys in places like the organization's content management system, messaging platform, or shared documents.

PoC

#!/bin/bash -x

# /snapshots/{key}: {'delete': {'success_status_code': 200, 'exec_paths': ['post /snapshots']}}
# 2d92c726-bf3c-4f20-b979-37bdf81d68c7

# Authentication stage

# User A - Grafana Admin
user_a_token="YWRtaW46YWRtaW4xMjM="

# User B - User with no permissions , which is not part of any org
user_b_token="YmJiOmJiYmJiYmJiYg=="

# Create snapshot
current_date=$(date +%Y-%m-%d-%H-%M-%S)
random_string="random-${current_date}"
snapshot_data='{"dashboard":{"annotations":{"list":[{"name":"Annotations & Alerts","enable":true,"iconColor":"rgba(0, 211, 255,…
Record
GHSA-67rv-qpw2-6qrr
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-639
Updated
2026-11-02
NVD 6.5

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized.

Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability.

This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.

Record
CVE-2024-1313
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-639
Updated
2026-11-02
OSV 6.5

Users outside an organization can delete a snapshot with its key

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized.

Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability.

This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.

Record
CVE-2024-1313
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-639
Updated
2026-11-02
OSVGHSA-67rv-qpw2-6qrr 7.1

Grafana: Users outside an organization can delete a snapshot with its key

Summary

The DELETE /api/snapshots/{key} endpoint allows any Grafana user to delete snapshots if the user is NOT in the organization of the snapshot

Details

An attacker (a user without organization affiliation or with a "no basic role" in an organization other than the one where the dashboard exists), knowing the key or URL of a snapshot created by any user (including Grafana admins), can delete a snapshot (It is not feasible using UI), resulting in a BOLA vulnerability. If an attacker is in the same organization of the dashboard snapshot, he can’t delete the snapshot. However, an attacker with low-privilege from a different organization would be able to delete it, resulting in the authorization flaw.

Precondition

To exploit this endpoint, an attacker must know the {key} of a snapshot. The attacker can potentially discover this key in various ways.

When creating a snapshot through the API, users can manually specify a key without any complexity requirements. This lack of complexity makes this key susceptible to brute force attacks. For example, simplistic keys such as "customer_key_123" or "admin_snap" can be easily guessed. These predictable keys allow low-privileged attackers to perform brute-force attacks using common keywords, potentially leading to compromised data integrity.

In addition, this key is displayed in plain text in the URL of a snapshot. This means that if a user publicly displays a snapshot, viewers might note down the key. Furthermore, since the snapshot feature is often used for sharing, displaying, and backing up data, a low-privileged attacker could potentially find snapshot keys in places like the organization's content management system, messaging platform, or shared documents.

PoC

#!/bin/bash -x

# /snapshots/{key}: {'delete': {'success_status_code': 200, 'exec_paths': ['post /snapshots']}}
# 2d92c726-bf3c-4f20-b979-37bdf81d68c7

# Authentication stage

# User A - Grafana Admin
user_a_token="YWRtaW46YWRtaW4xMjM="

# User B - User with no permissions , which is not part of any org
user_b_token="YmJiOmJiYmJiYmJiYg=="

# Create snapshot
current_date=$(date +%Y-%m-%d-%H-%M-%S)
random_string="random-${current_date}"
snapshot_data='{"dashboard":{"annotations":{"list":[{"name":"Annotations & Alerts","enable":true,"iconColor":"rgba(0, 211, 255,…
Record
GHSA-67rv-qpw2-6qrr
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-639
Updated
2026-11-02
Show 16 moreShow less
OSVRHSA-2024:2568 7.5

Red Hat Security Advisory: grafana security update

Record
RHSA-2024:2568
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:3265 7.5

Red Hat Security Advisory: grafana security update

Record
RHSA-2024:3265
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-1313 6.5

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability. This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.

Record
UBUNTU-CVE-2024-1313
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2024:2568 No score

Moderate: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
  • grafana: vulnerable to authorization bypass (CVE-2024-1313)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:2568
Updated
2026-11-02
OSVALSA-2024:3265 No score

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
  • grafana: vulnerable to authorization bypass (CVE-2024-1313)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:3265
Updated
2026-11-02
OSVBIT-grafana-2024-1313 No score

Users outside an organization can delete a snapshot with its key

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized.

Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability.

This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.

Record
BIT-grafana-2024-1313
Updated
2026-11-02
OSVGO-2024-2697 No score

Grafana: Users outside an organization can delete a snapshot with its key in github.com/grafana/grafana

Grafana: Users outside an organization can delete a snapshot with its key in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana from v9.5.0 before v9.5.18, from v10.0.0 before v10.0.13, from v10.1.0 before v10.1.9, from v10.2.0 before v10.2.6, from v10.3.0 before v10.3.5.

Record
GO-2024-2697
Updated
2026-11-02
OSVopenSUSE-SU-2024:13831-1 No score

grafana-10.3.5-1.1 on GA media

These are all security issues fixed in the grafana-10.3.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13831-1
Updated
2026-11-02
OSVRLSA-2024:2568 No score

Moderate: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

  • grafana: vulnerable to authorization bypass (CVE-2024-1313)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2024:2568
Updated
2026-11-02
OSVRLSA-2024:3265 No score

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

  • grafana: vulnerable to authorization bypass (CVE-2024-1313)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2024:3265
Updated
2026-11-02
OSVSUSE-SU-2024:1508-1 No score

Security update for SUSE Manager Client Tools

This update fixes the following issues:

golang-github-prometheus-node_exporter:

  • Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):
    • [FEATURE] Add ZFS freebsd per dataset stats #2753
    • [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721
    • [ENHANCEMENT] Parallelize stat calls in Linux filesystem collector #1772
    • [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711
    • [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric #2778
    • [ENHANCEMENT] Improve qdisc collector performance #2779
    • [ENHANCEMENT] Add include and exclude filter for hwmon collector #2699
    • [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead of procfs #2777
    • [BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754
    • [BUGFIX] Fallback to 32-bit stats in netdev #2757
    • [BUGFIX] Close btrfs.FS handle after use #2780
    • [BUGFIX] Move RO status before error return #2807
    • [BUFFIX] Fix promhttp_metric_handler_errors_total being always active #2808
    • [BUGFIX] Fix nfsd v4 index miss #2824
  • Update to 1.6.1: (no source code changes in this release)
  • BuildRequire go1.20
  • Update to 1.6.0:
    • [CHANGE] Fix cpustat when some cpus are offline #2318
    • [CHANGE] Remove metrics of offline CPUs in CPU collector #2605
    • [CHANGE] Deprecate ntp collector #2603
    • [CHANGE] Remove bcache cache_readaheads_totals metrics #2583
    • [CHANGE] Deprecate supervisord collector #2685
    • [FEATURE] Enable uname collector on NetBSD #2559
    • [FEATURE] NetBSD support for the meminfo collector #2570
    • [FEATURE] NetBSD support for CPU collector #2626
    • [FEATURE] Add FreeBSD collector for netisr subsystem #2668
    • [FEATURE] Add softirqs collector #2669
    • [ENHANCEMENT] Add suspended as a node_zfs_zpool_state #2449
    • [ENHANCEMENT] Add administrative state of Linux network interfaces #2515
    • [ENHANCEMENT] Log current value of GOMAXPROCS #2537
    • [ENHANCEMENT] Add profiler options for perf collector #2542
    • [ENHANCEMENT] Allow root path as metrics path #2590
    • [ENHANCEMENT] Add cpu frequency governor metrics #2569
    • [ENHANCEMENT] Add new landing page #2622
    • [ENHANCEMENT] Reduce privileges needed for btrfs device stats #2634
    • [ENHANCEMENT] Add ZFS memory_available_bytes #2687
    • [ENHANCEMENT] Use SCSI_IDENT_SERIAL as serial in diskstats #2612
    • [ENHANCEMENT] Read missing from netlink netclass attributes from sysfs #2669
    • [BUGFIX] perf: fixes for automatically detecting the correct tracefs mountpoints #2553
    • [BUGFIX] Fix thermal_zone collector noise @2554
    • [BUGFIX] Fix a problem fetching the user wire count on FreeBSD 2584
    • [BUGFIX] interrupts: Fix fields on linux aarch64 #2631
    • [BUGFIX] Remove metrics of offline CPUs in CPU collector #2605
    • [BUGFIX] Fix OpenBSD filesystem collector string parsing #2637
    • [BUGFIX] Fix bad reporting of node_cpu_seconds_total in OpenBSD #2663
  • Change go_modules archive in _service to use obscpio file

grafana:

  • Packaging improvements:
    • Changed deprecated disabled service mode to manual
    • Drop golang-packaging macros
    • Drop explicit mod=vendor as it is enabled automatically
  • Update to version 9.5.18:
    • [SECURITY] CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
  • Update to version 9.5.17:
    • [FEATURE] Alerting: Backport use Alertmanager API v2
  • Require Go 1.20
  • Update to version 9.5.16:
    • [SECURITY] CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
    • [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL
  • Update to version 9.5.15:
    • [FEATURE] Alerting: Attempt to retry retryable errors
  • Update to version 9.5.14:
    • [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error
    • [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied
    • [BUGFIX] LDAP: Fix enable users on…
Record
SUSE-SU-2024:1508-1
Updated
2026-11-02
OSVSUSE-SU-2024:1509-1 No score

Security update for SUSE Manager Client Tools

This update fixes the following issues:

POS_Image-Graphical7 was updated to version 0.1.1710765237.46af599:

  • Version 0.1.1710765237.46af599

    • Moved image services to dracut-saltboot package
    • Use salt bundle

  • Version 0.1.1645440615.7f1328c

    • Removed deprecated kiwi functions

POS_Image-JeOS7 was updated to version 0.1.1710765237.46af599:

  • Version 0.1.1710765237.46af599

    • Moved image services to dracut-saltboot package
    • Use salt bundle

  • Version 0.1.1645440615.7f1328c

    • Removed deprecated kiwi functions

ansible received the following fixes:

  • Security issues fixed:

    • CVE-2023-5764: Address issues where internal templating can cause unsafe variables to lose their unsafe designation (bsc#1216854)

      • Breaking changes: assert - Nested templating may result in an inability for the conditional to be evaluated. See the porting guide for more information.

    • CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)

    • CVE-2020-14365: Ensure that packages are GPG validated (bsc#1175993)

    • CVE-2020-10744: Fixed insecure temporary directory creation (bsc#1171823)

    • CVE-2018-10874: Fixed inventory variables loading from current working directory when running ad-hoc command that can lead to code execution (bsc#1099805)

  • Bugs fixed:

    • Don't Require python-coverage, it is needed only for testing (bsc#1177948)

dracut-saltboot was updated to version 0.1.1710765237.46af599:

  • Version 0.1.1710765237.46af599

    • Load only first available leaseinfo (bsc#1221092)

  • Version 0.1.1681904360.84ef141

grafana was updated to version 9.5.18:

  • Grafana now requires Go 1.20

  • Security issues fixed:

    • CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
    • CVE-2023-6152: Add email verification when updating user email (bsc#1219912)

  • Other non-security related changes:

    • Version 9.5.17:

      • [FEATURE] Alerting: Backport use Alertmanager API v2

    • Version 9.5.16:

      • [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL

    • Version 9.5.15:

      • [FEATURE] Alerting: Attempt to retry retryable errors

    • Version 9.5.14:

      • [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error
      • [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied
      • [BUGFIX] LDAP: Fix enable users on successfull login

    • Version 9.5.13:

      • [BUGFIX] BrowseDashboards: Only remember the most recent expanded folder
      • [BUGFIX] Licensing: Pass func to update env variables when starting plugin

    • Version 9.5.12:

      • [FEATURE] Azure: Add support for Workload Identity authentication

    • Version 9.5.9:

      • [FEATURE] SSE: Fix DSNode to not panic when response has empty response
      • [FEATURE] Prometheus: Handle the response with different field key order
      • [BUGFIX] LDAP: Fix user disabling

mgr-daemon was updated to version 4.3.9-0:

  • Version 4.3.9-0

    • Update translation strings

spacecmd was updated to version 4.3.27-0:

  • Version 4.3.27-0

    • Update translation strings

spacewalk-client-tools was updated to version 4.3.19-0:

  • Version 4.3.19-0

    • Update translation strings

spacewalk-koan was updated to version version 4.3.6-0:

  • Version 4.3.6-0

    • Change Docker image location for test

uyuni-common-libs was updated to version 4.3.10-0:

  • Version 4.3.10-0

    • Add support for package signature type V4 RSA/SHA384
    • Add support for package signature type V4 RSA/SHA512 (bsc#1221465)

uyuni-proxy-systemd-services was updated to version 4.3.12-0:

  • Version 4.3.12-0

    • Update to SUSE Manager 4.3.12
Record
SUSE-SU-2024:1509-1
Updated
2026-11-02
OSVSUSE-SU-2024:1530-1 No score

Security update for grafana and mybatis

This update for grafana and mybatis fixes the following issues:

grafana was updated to version 9.5.18:

  • Grafana now requires Go 1.20

  • Security issues fixed:

    • CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
    • CVE-2023-6152: Add email verification when updating user email (bsc#1219912)

  • Other non-security related changes:

    • Version 9.5.17:

      • [FEATURE] Alerting: Backport use Alertmanager API v2

    • Version 9.5.16:

      • [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL

    • Version 9.5.15:

      • [FEATURE] Alerting: Attempt to retry retryable errors

    • Version 9.5.14:

      • [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error
      • [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied
      • [BUGFIX] LDAP: Fix enable users on successfull login

    • Version 9.5.13:

      • [BUGFIX] BrowseDashboards: Only remember the most recent expanded folder
      • [BUGFIX] Licensing: Pass func to update env variables when starting plugin

    • Version 9.5.12:

      • [FEATURE] Azure: Add support for Workload Identity authentication

    • Version 9.5.9:

      • [FEATURE] SSE: Fix DSNode to not panic when response has empty response
      • [FEATURE] Prometheus: Handle the response with different field key order
      • [BUGFIX] LDAP: Fix user disabling

mybatis:

  • apache-commons-ognl is now a non-optional dependency
  • Fixed building with log4j v1 and v2 dependencies
Record
SUSE-SU-2024:1530-1
Updated
2026-11-02
OSVSUSE-SU-2024:1530-2 No score

Security update for grafana and mybatis

This update for grafana and mybatis fixes the following issues:

grafana was updated to version 9.5.18:

  • Grafana now requires Go 1.20

  • Security issues fixed:

    • CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
    • CVE-2023-6152: Add email verification when updating user email (bsc#1219912)

  • Other non-security related changes:

    • Version 9.5.17:

      • [FEATURE] Alerting: Backport use Alertmanager API v2

    • Version 9.5.16:

      • [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL

    • Version 9.5.15:

      • [FEATURE] Alerting: Attempt to retry retryable errors

    • Version 9.5.14:

      • [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error
      • [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied
      • [BUGFIX] LDAP: Fix enable users on successfull login

    • Version 9.5.13:

      • [BUGFIX] BrowseDashboards: Only remember the most recent expanded folder
      • [BUGFIX] Licensing: Pass func to update env variables when starting plugin

    • Version 9.5.12:

      • [FEATURE] Azure: Add support for Workload Identity authentication

    • Version 9.5.9:

      • [FEATURE] SSE: Fix DSNode to not panic when response has empty response
      • [FEATURE] Prometheus: Handle the response with different field key order
      • [BUGFIX] LDAP: Fix user disabling

mybatis:

  • apache-commons-ognl is now a non-optional dependency
  • Fixed building with log4j v1 and v2 dependencies
Record
SUSE-SU-2024:1530-2
Updated
2026-11-02
OSVSUSE-SU-2024:1814-1 No score

Security Beta update for SUSE Manager Client Tools and Salt

This update fixes the following issues:

golang-github-prometheus-node_exporter:

  • Add device_error label for filesystem metrics.
  • Update rtnetlink library to fix errors during ARP metrics collection.
  • update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):
    • [FEATURE] Add ZFS freebsd per dataset stats #2753
    • [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721
    • [ENHANCEMENT] Parallelize stat calls in Linux filesystem collector #1772
    • [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711
    • [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric #2778
    • [ENHANCEMENT] Improve qdisc collector performance #2779
    • [ENHANCEMENT] Add include and exclude filter for hwmon collector #2699
    • [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead of procfs #2777
    • [BUGFIX] Fallback to 32-bit stats in netdev #2757
    • [BUGFIX] Close btrfs.FS handle after use #2780
    • [BUGFIX] Move RO status before error return #2807
    • [BUFFIX] Fix promhttp_metric_handler_errors_total being always active #2808
    • [BUGFIX] Fix nfsd v4 index miss #2824
  • update to 1.6.1:
    • Rebuild with updated Go version, no source code changes in this release.
  • update to 1.6.0:
    • [CHANGE] Fix cpustat when some cpus are offline #2318
    • [CHANGE] Remove metrics of offline CPUs in CPU collector #2605
    • [CHANGE] Deprecate ntp collector #2603
    • [CHANGE] Remove bcache cache_readaheads_totals metrics #2583
    • [CHANGE] Deprecate supervisord collector #2685
    • [FEATURE] Add softirqs collector #2669
    • [ENHANCEMENT] Add suspended as a node_zfs_zpool_state #2449
    • [ENHANCEMENT] Add administrative state of Linux network interfaces #2515
    • [ENHANCEMENT] Log current value of GOMAXPROCS #2537
    • [ENHANCEMENT] Add profiler options for perf collector #2542
    • [ENHANCEMENT] Allow root path as metrics path #2590
    • [ENHANCEMENT] Add cpu frequency governor metrics #2569
    • [ENHANCEMENT] Add new landing page #2622
    • [ENHANCEMENT] Reduce privileges needed for btrfs device stats #2634
    • [ENHANCEMENT] Add ZFS memory_available_bytes #2687
    • [ENHANCEMENT] Use SCSI_IDENT_SERIAL as serial in diskstats #2612
    • [ENHANCEMENT] Read missing from netlink netclass attributes from sysfs #2669
    • [BUGFIX] perf: fixes for automatically detecting the correct tracefs mountpoints #2553
    • [BUGFIX] Fix thermal_zone collector noise #2554
    • [BUGFIX] interrupts: Fix fields on linux aarch64 #2631
    • [BUGFIX] Remove metrics of offline CPUs in CPU collector #2605

grafana:

  • Packaging improvements:
    • Changed deprecated disabled service mode to manual
    • Drop golang-packaging macros
    • Drop explicit mod=vendor as it is enabled automatically
  • Update to version 9.5.18:
    • [SECURITY] CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
  • Update to version 9.5.17:
    • [FEATURE] Alerting: Backport use Alertmanager API v2

mgr-push:

  • Version 5.0.2-0
    • Remove unused code from the traditional stack
    • Use bundle CA certificate in rhnpush (bsc#1222731)

spacecmd:

  • Version 5.0.6-0
    • Update translations

uyuni-common-libs:

  • Version 5.0.3-0
    • Add support for package signature type V4 RSA/SHA384
    • Add support for package signature type V4 RSA/SHA512 (bsc#1221465)

uyuni-tools:

  • Version 0.1.9-0
    • Redact passwords from the API payload in traces
    • Fix build on Ubuntu 20.04 due to version change
  • Version 0.1.8-0
    • Add 'mgradm support sql' command
    • Improve GPG help
    • podman-mount* flag should be used only on Server installation and migration
    • Add flag groups in help text
    • Attach Proxy pod to our Podman network
    • Create support ptf commands
    • Create mgrpxy upgrade command
    • Add domain for internal container network
    • Stop the Server if first user creation failed
    • Add localization support
    • Require Podman 4.5.0 for its --shm-size-systemd parameter
    • Add --podman-mount-www flag for install and migration
    • Only colorize output if outputting to a…
Record
SUSE-SU-2024:1814-1
Updated
2026-11-02
OSVSUSE-SU-2024:1815-1 No score

Security Beta update for SUSE Manager Client Tools

This update fixes the following issues:

grafana:

  • Packaging improvements:
    • Changed deprecated disabled service mode to manual
    • Drop golang-packaging macros
    • Drop explicit mod=vendor as it is enabled automatically
  • Update to version 9.5.18:
    • [SECURITY] CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
  • Update to version 9.5.17:
    • [FEATURE] Alerting: Backport use Alertmanager API v2

mgr-push:

  • Version 5.0.2-0
    • Remove unused code from the traditional stack
    • Use bundle CA certificate in rhnpush (bsc#1222731)

spacecmd:

  • Version 5.0.6-0
    • Update translations

uyuni-common-libs:

  • Version 5.0.3-0
    • Add support for package signature type V4 RSA/SHA384
    • Add support for package signature type V4 RSA/SHA512 (bsc#1221465)

uyuni-tools:

  • Version 0.1.9-0
    • Redact passwords from the API payload in traces
    • Fix build on Ubuntu 20.04 due to version change
  • Version 0.1.8-0
    • Add 'mgradm support sql' command
    • Improve GPG help
    • podman-mount* flag should be used only on Server installation and migration
    • Add flag groups in help text
    • Attach Proxy pod to our Podman network
    • Create support ptf commands
    • Create mgrpxy upgrade command
    • Add domain for internal container network
    • Stop the Server if first user creation failed
    • Add localization support
    • Require Podman 4.5.0 for its --shm-size-systemd parameter
    • Add --podman-mount-www flag for install and migration
    • Only colorize output if outputting to a terminal
    • Fix output missing newlines due to the spinner
    • Add product version and commit id to the version output
    • Add missing whitespace between podman common arguments and additional ones
    • Bump the push tag to 5.0.0-RC
    • Add gpg command to mgradm
    • Hide message in stdout if SCCcredentials is missing (bsc#1222277)
    • Redact password in stdout and uyuni-tools.log
    • Rework distribution mapping to work with distros without .treeinfo data
    • Add initial installation support for Confidental Computing attestation container
    • Allow PAM and LDAP authentication using SSSD
    • Change pull policy default to Always during upgrade
    • Allow migration with non-root user on source server
Record
SUSE-SU-2024:1815-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 9.5.0 up to 9.5.18
9.5.18
github.com/grafana/grafana
Go
 10.0.0 up to 10.0.13
10.0.13
github.com/grafana/grafana
Go
 10.1.0 up to 10.1.9
10.1.9
github.com/grafana/grafana
Go
 10.2.0 up to 10.2.6
10.2.6
github.com/grafana/grafana
Go
 10.3.0 up to 10.3.5
10.3.5
grafana
AlmaLinux:9
 before 9.2.10-16.el9_4.alma.1
9.2.10-16.el9_4.alma.1
grafana-selinux
AlmaLinux:9
 before 9.2.10-16.el9_4.alma.1
9.2.10-16.el9_4.alma.1
grafana
AlmaLinux:8
 before 9.2.10-16.el8_10
9.2.10-16.el8_10
grafana-selinux
AlmaLinux:8
 before 9.2.10-16.el8_10
9.2.10-16.el8_10
grafana
Bitnami
 9.5.0 up to 9.5.18, 10.0.0 up to 10.0.13, 10.1.0 up to 10.1.9, 10.2.0 up to 10.2.6, 10.3.0 up to 10.3.5
9.5.1810.0.1310.1.910.2.610.3.5
Show 64 moreShow less
Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 All versions None known
grafana
Red Hat:enterprise_linux:9::appstream
 before 0:9.2.10-16.el9_4
0:9.2.10-16.el9_4
grafana-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:9.2.10-16.el9_4
0:9.2.10-16.el9_4
grafana-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:9.2.10-16.el9_4
0:9.2.10-16.el9_4
grafana-selinux
Red Hat:enterprise_linux:9::appstream
 before 0:9.2.10-16.el9_4
0:9.2.10-16.el9_4
grafana
Red Hat:enterprise_linux:8::appstream
 before 0:9.2.10-16.el8_10
0:9.2.10-16.el8_10
grafana-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:9.2.10-16.el8_10
0:9.2.10-16.el8_10
grafana-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:9.2.10-16.el8_10
0:9.2.10-16.el8_10
grafana-selinux
Red Hat:enterprise_linux:8::appstream
 before 0:9.2.10-16.el8_10
0:9.2.10-16.el8_10
grafana
Rocky Linux:9
 before 0:9.2.10-16.el9_4
0:9.2.10-16.el9_4
grafana
Rocky Linux:8
 before 0:9.2.10-16.el8_10
0:9.2.10-16.el8_10
golang-github-prometheus-alertmanager
SUSE:Manager Client Tools 12
 before 0.26.0-1.27.2
0.26.0-1.27.2
golang-github-prometheus-node_exporter
SUSE:Manager Client Tools 12
 before 1.7.0-1.30.2
1.7.0-1.30.2
golang-github-prometheus-promu
SUSE:Manager Client Tools 12
 before 0.14.0-1.18.1
0.14.0-1.18.1
grafana
SUSE:Manager Client Tools 12
 before 9.5.18-1.63.1
9.5.18-1.63.1
mgr-daemon
SUSE:Manager Client Tools 12
 before 4.3.9-1.47.1
4.3.9-1.47.1
spacecmd
SUSE:Manager Client Tools 12
 before 4.3.27-38.139.1
4.3.27-38.139.1
spacewalk-client-tools
SUSE:Manager Client Tools 12
 before 4.3.19-52.98.1
4.3.19-52.98.1
spacewalk-koan
SUSE:Manager Client Tools 12
 before 4.3.6-24.36.1
4.3.6-24.36.1
uyuni-common-libs
SUSE:Manager Client Tools 12
 before 4.3.10-1.39.1
4.3.10-1.39.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server 12 SP5
 before 1.7.0-1.30.2
1.7.0-1.30.2
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.7.0-1.30.2
1.7.0-1.30.2
POS_Image-Graphical7
SUSE:Manager Client Tools 15
 before 0.1.1710765237.46af599-150000.1.21.2
0.1.1710765237.46af599-150000.1.21.2
POS_Image-JeOS7
SUSE:Manager Client Tools 15
 before 0.1.1710765237.46af599-150000.1.21.2
0.1.1710765237.46af599-150000.1.21.2
ansible
SUSE:Manager Client Tools 15
 before 2.9.27-150000.1.17.2
2.9.27-150000.1.17.2
dracut-saltboot
SUSE:Manager Client Tools 15
 before 0.1.1710765237.46af599-150000.1.53.2
0.1.1710765237.46af599-150000.1.53.2
grafana
SUSE:Manager Client Tools 15
 before 9.5.18-150000.1.63.2
9.5.18-150000.1.63.2
mgr-daemon
SUSE:Manager Client Tools 15
 before 4.3.9-150000.1.47.2
4.3.9-150000.1.47.2
spacecmd
SUSE:Manager Client Tools 15
 before 4.3.27-150000.3.116.2
4.3.27-150000.3.116.2
spacewalk-client-tools
SUSE:Manager Client Tools 15
 before 4.3.19-150000.3.89.2
4.3.19-150000.3.89.2
spacewalk-koan
SUSE:Manager Client Tools 15
 before 4.3.6-150000.3.33.2
4.3.6-150000.3.33.2
uyuni-common-libs
SUSE:Manager Client Tools 15
 before 4.3.10-150000.1.39.2
4.3.10-150000.1.39.2
uyuni-proxy-systemd-services
SUSE:Manager Client Tools 15
 before 4.3.12-150000.1.21.2
4.3.12-150000.1.21.2
dracut-saltboot
SUSE:Manager Client Tools for SLE Micro 5
 before 0.1.1710765237.46af599-150000.1.53.2
0.1.1710765237.46af599-150000.1.53.2
uyuni-proxy-systemd-services
SUSE:Manager Client Tools for SLE Micro 5
 before 4.3.12-150000.1.21.2
4.3.12-150000.1.21.2
golang-github-prometheus-promu
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 0.14.0-150000.3.18.2
0.14.0-150000.3.18.2
ansible
SUSE:Manager Proxy Module 4.3
 before 2.9.27-150000.1.17.2
2.9.27-150000.1.17.2
uyuni-proxy-systemd-services
SUSE:Manager Proxy Module 4.3
 before 4.3.12-150000.1.21.2
4.3.12-150000.1.21.2
POS_Image-Graphical7
openSUSE:Leap 15.5
 before 0.1.1710765237.46af599-150000.1.21.2
0.1.1710765237.46af599-150000.1.21.2
POS_Image-JeOS7
openSUSE:Leap 15.5
 before 0.1.1710765237.46af599-150000.1.21.2
0.1.1710765237.46af599-150000.1.21.2
ansible
openSUSE:Leap 15.5
 before 2.9.27-150000.1.17.2
2.9.27-150000.1.17.2
dracut-saltboot
openSUSE:Leap 15.5
 before 0.1.1710765237.46af599-150000.1.53.2
0.1.1710765237.46af599-150000.1.53.2
golang-github-prometheus-promu
openSUSE:Leap 15.5
 before 0.14.0-150000.3.18.2
0.14.0-150000.3.18.2
spacecmd
openSUSE:Leap 15.5
 before 4.3.27-150000.3.116.2
4.3.27-150000.3.116.2
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 9.5.18-150200.3.56.1
9.5.18-150200.3.56.1
grafana
openSUSE:Leap 15.5
 before 9.5.18-150200.3.56.1
9.5.18-150200.3.56.1
mybatis
openSUSE:Leap 15.5
 before 3.5.6-150200.5.6.1
3.5.6-150200.5.6.1
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 9.5.18-150200.3.56.1
9.5.18-150200.3.56.1
grafana
openSUSE:Leap 15.6
 before 9.5.18-150200.3.56.1
9.5.18-150200.3.56.1
mybatis
openSUSE:Leap 15.6
 before 3.5.6-150200.5.6.1
3.5.6-150200.5.6.1
grafana
SUSE:Manager Client Tools 15-BETA
 before 9.5.18-159000.4.33.4
9.5.18-159000.4.33.4
mgr-push
SUSE:Manager Client Tools 15-BETA
 before 5.0.2-159000.4.24.5
5.0.2-159000.4.24.5
spacecmd
SUSE:Manager Client Tools 15-BETA
 before 5.0.6-159000.6.51.4
5.0.6-159000.6.51.4
uyuni-common-libs
SUSE:Manager Client Tools 15-BETA
 before 5.0.3-159000.3.39.3
5.0.3-159000.3.39.3
uyuni-tools
SUSE:Manager Client Tools 15-BETA
 before 0.1.9-159000.3.11.5
0.1.9-159000.3.11.5
golang-github-prometheus-node_exporter
SUSE:Manager Client Tools Beta for SLE Micro 5
 before 1.7.0-159000.6.5.5
1.7.0-159000.6.5.5
uyuni-tools
SUSE:Manager Client Tools Beta for SLE Micro 5
 before 0.1.9-159000.3.11.5
0.1.9-159000.3.11.5
grafana
SUSE:Manager Client Tools 12-BETA
 before 9.5.18-4.30.4
9.5.18-4.30.4
mgr-push
SUSE:Manager Client Tools 12-BETA
 before 5.0.2-4.24.5
5.0.2-4.24.5
spacecmd
SUSE:Manager Client Tools 12-BETA
 before 5.0.6-41.51.3
5.0.6-41.51.3
uyuni-common-libs
SUSE:Manager Client Tools 12-BETA
 before 5.0.3-3.39.3
5.0.3-3.39.3
uyuni-tools
SUSE:Manager Client Tools 12-BETA
 before 0.1.9-3.11.4
0.1.9-3.11.4
grafana
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.6.0+dfsg-1
 None known
grafana
openSUSE:Tumbleweed
 before 10.3.5-1.1
10.3.5-1.1

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-1313 is a medium vulnerability (CVSS 6.5) in Grafana, published March 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in github.com/grafana/grafana 9.5.18.

References

Show 68 moreShow less
This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open