CVE catalog

CVE-2024-1442

UBUNTU-CVE-2024-1442

Severity: Medium · CVSS 6CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Published: Mar 7, 2024, 12:00:00 AM UTC
Updated: Oct 24, 2025, 5:06:41 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.80% · Oct 25, 2026

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Ubuntu	grafana	16.04	`2.6.0+dfsg-1`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[https://osv.dev/vulnerability/UBUNTU-CVE-2024-1442]
[https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-1442.json]

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]