Security Advisory

CVE-2024-9264

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2024-10-18 03:20:52

Last updated 2025-03-14 10:03:06

Assigner GRAFANA

CVSS score 9.4

State PUBLISHED

Description

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

← Browse all CVEs View on cve.org ↗