8000 x/vulndb: potential Go vuln in github.com/grafana/grafana: GHSA-wxcc-2f3q-4h58 · Issue #3438 · golang/vulndb · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
x/vulndb: potential Go vuln in github.com/grafana/grafana: GHSA-wxcc-2f3q-4h58 #3438
New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in github.com/grafana/grafana: GHSA-wxcc-2f3q-4h58#3438
Labels
triaged
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on Jan 31, 2025

Advisory GHSA-wxcc-2f3q-4h58 references a vulnerability in the following Go modules:

Module
github.com/grafana/grafana

Description:
Grafana is an open-source platform for monitoring and observability.
The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission.
Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/grafana/grafana
      non_go_versions:
        - introduced: TODO (earliest fixed "11.4.1", vuln range "= 11.4.0")
        - fixed: 10.4.15
        - introduced: 11.0.0
        - fixed: 11.0.11
        - introduced: 11.1.0
        - fixed: 11.1.11
        - introduced: 11.2.0
        - fixed: 11.2.6
        - introduced: 11.3.0
        - fixed: 11.3.3
      vulnerable_at: 5.4.5+incompatible
summary: |-
    Grafana Alerting VictorOps integration could be exposed to users with Viewer
    permission in github.com/grafana/grafana
cves:
    - CVE-2024-11741
ghsas:
    - GHSA-wxcc-2f3q-4h58
references:
    - advisory: https://github.com/advisories/GHSA-wxcc-2f3q-4h58
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-11741
    - web: https://grafana.com/security/security-advisories/cve-2024-11741
notes:
    - fix: 'module merge error: could not merge versions of module github.com/grafana/grafana: invalid or non-canonical semver version (found TODO (earliest fixed "11.4.1", vuln range "= 11.4.0"))'
source:
    id: GHSA-wxcc-2f3q-4h58
    created: 2025-01-31T22:01:41.790748466Z
review_status: UNREVIEWED

Metadata

Metadata

Assignees

No one assigned

    Labels

    triaged

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions
      0