Organization admins can delete pending invites created in an organization they are not part of.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Organization admins can delete pending invites created in an organization they are not part of.
    (CVE-2024-10452)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Organization admins can delete pending invites created in an organization they are not part of.
    (CVE-2024-10452)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0596 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-1088:
    An access control vulnerability was discovered in Grafana OSS where an Organization administrator could     permanently delete the Server administrator account. This vulnerability exists in the DELETE     /api/org/users/ endpoint.

    The vulnerability can be exploited when:

    1. An Organization administrator exists

    2. The Server administrator is either:

     - Not part of any organization, or
     - Part of the same organization as the Organization administrator     Impact:

    - Organization administrators can permanently delete Server administrator accounts

    - If the only Server administrator is deleted, the Grafana instance becomes unmanageable

    - No super-user permissions remain in the system

    - Affects all users, organizations, and teams managed in the instance

    The vulnerability is particularly serious as it can lead to a complete loss of administrative control over     the Grafana instance.

    CVE-2024-10452:
    Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing     integration was not properly protected and could be exposed to users with Viewer permission.
    Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01,     11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

    CVE-2025-3580:
    In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become     unresponsive due to Improper Input Validation vulnerability in Grafana.
    This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

    CVE-2025-3415:
    Organization admins can delete pending invites created in an organization they are not part of.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3950-1 advisory.

    - Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww
      * GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97
      * GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r
      * GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch
      * GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq
      * GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw
      * GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h
      * GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh
      * GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj

    - Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g
      * GO-2024-3245 CVE-2024-39720
      * GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
446619	SCA: security update for github.com/grafana/grafana (GHSA-66c4-2g2v-54qw)	Tenable Cloud Security	SCA Checks	Local	low
446619	SCA: security update for github.com/grafana/grafana (GHSA-66c4-2g2v-54qw)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
250899	Linux Distros Unpatched Vulnerability : CVE-2024-10452	Nessus	Misc.	Local	low
249979	TencentOS Server 4: grafana (TSSA-2025:0596)	Nessus	Tencent Local Security Checks	Local	low
210710	SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2024:3950-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2024-10452

low

Tenable Plugins

low

low

low

low

high