In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

According to its self-reported version, the Grafana install hosted on the remote host is 10.3.x earlier than 10.3.10, or 10.4.x earlier than 10.4.9, or 11.0.x earlier than 11.0.5, or 11.1.x earlier than 11.1.6, or 11.2.x earlier than 11.2.1. It is, therefore, affected by multiple vulnerabilities:

- A Code Injection vulnerability.

- A Improper Isolation Or Compartmentalization vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with     permission to write external alert instances to also write alert rules. (CVE-2024-8118)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0545-1 advisory.

    grafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):

    - Security issues fixed:
      * CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading         golang.org/x/crypto (bsc#1234554)
      * CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)
      * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
      * CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)
      * CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)

    - Potential breaking changes in version 10:
      * In panels using the `extract fields` transformation, where one         of the extracted names collides with one of the already         existing ields, the extracted field will be renamed.
      * For the existing backend mode users who have table         visualization might see some inconsistencies on their panels.
        We have updated the table column naming. This will         potentially affect field transformations and/or field         overrides. To resolve this either: update transformation or         field override.
      * For the existing backend mode users who have Transformations         with the `time` field, might see their transformations are         not working. Those panels that have broken transformations         will fail to render. This is because we changed the field         key. To resolve this either: Remove the affected panel and         re-create it; Select the `Time` field again; Edit the `time`         field as `Time` for transformation in `panel.json` or         `dashboard.json`
      * The following data source permission endpoints have been removed:
        `GET /datasources/:datasourceId/permissions`         `POST /api/datasources/:datasourceId/permissions`         `DELETE /datasources/:datasourceId/permissions`         `POST /datasources/:datasourceId/enable-permissions`         `POST /datasources/:datasourceId/disable-permissions`
        - Please use the following endpoints instead:
          `GET /api/access-control/datasources/:uid` for listing data            source permissions           `POST /api/access-control/datasources/:uid/users/:id`,           `POST /api/access-control/datasources/:uid/teams/:id` and           `POST /api/access-control/datasources/:uid/buildInRoles/:id`           for adding or removing data source permissions
      * If you are using Terraform Grafana provider to manage data source permissions, you will need to     upgrade your         provider.
      * For the existing backend mode users who have table visualization might see some inconsistencies on     their panels.
        We have updated the table column naming. This will potentially affect field transformations and/or     field overrides.
      * The deprecated `/playlists/{uid}/dashboards` API endpoint has been removed.
        Dashboard information can be retrieved from the `/dashboard/...` APIs.
      * The `PUT /api/folders/:uid` endpoint no more supports modifying the folder's `UID`
      * Removed all components for the old panel header design.
      * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-3/         for more details
      * OAuth role mapping enforcement: This change impacts GitHub,         Gitlab, Okta, and Generic OAuth. To avoid overriding manually         set roles, enable the skip_org_role_sync option in the         Grafana configuration for your OAuth provider before         upgrading
      * Angular has been deprecated
      * Grafana legacy alerting has been deprecated
      * API keys are migrating to service accounts
      * The experimental dashboard previews feature is removed
      * Usernames are now case-insensitive by default
      * Grafana OAuth integrations do not work anymore with email lookups
      * The Alias field in the CloudWatch data source is removed
      * Athena data source plugin must be updated to version >=2.9.3
      * Redshift data source plugin must be updated to version >=1.8.3
      * DoiT International BigQuery plugin no longer supported
      * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-0         for more details

    - This update brings many new features, enhancements and fixes highlighted at:
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-4/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-3/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-2/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-1/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-0/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0525-1 advisory.

    dracut-saltboot was updated to version 0.1.1728559936.c16d4fb:

    - Added MAC based terminal naming option (jsc#SUMA-314)

    golang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 (jsc#PED-11649):

    - Security issues fixed:
      * CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error         handling (bsc#1232970)

    - Highlights of other changes:
      * Performance:
        - Significant enhancements to PromQL execution speed, TSDB operations (especially querying and     compaction) and           remote write operations.
        - Default GOGC value lowered to 75 for better memory management.
        - Option to limit memory usage from dropped targets added.
      * New Features:
        - Experimental OpenTelemetry ingestion.
        - Automatic memory limit handling.
        - Native histogram support, including new functions, UI enhancements, and improved scraping.
        - Improved alerting features, such as relabeling rules for AlertmanagerConfig and a new query_offset     option.
        - Expanded service discovery options with added metadata and support for new services.
        - New promtool commands for PromQL formatting, label manipulation, metric pushing, and OpenMetrics     dumping.
      * Bug Fixes:
        - Numerous fixes across scraping, API, TSDB, PromQL, and service discovery.
      * For a detailed list of changes consult the package changelog or         https://github.com/prometheus/prometheus/compare/v2.45.6...v2.53.3

    grafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):

    - Security issues fixed:
      * CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading         golang.org/x/crypto (bsc#1234554)
      * CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)
      * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
      * CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)
      * CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)

    - Potential breaking changes in version 10:
      * In panels using the `extract fields` transformation, where one         of the extracted names collides with one of the already         existing ields, the extracted field will be renamed.
      * For the existing backend mode users who have table         visualization might see some inconsistencies on their panels.
        We have updated the table column naming. This will         potentially affect field transformations and/or field         overrides. To resolve this either: update transformation or         field override.
      * For the existing backend mode users who have Transformations         with the `time` field, might see their transformations are         not working. Those panels that have broken transformations         will fail to render. This is because we changed the field         key. To resolve this either: Remove the affected panel and         re-create it; Select the `Time` field again; Edit the `time`         field as `Time` for transformation in `panel.json` or         `dashboard.json`
      * The following data source permission endpoints have been removed:
        `GET /datasources/:datasourceId/permissions`         `POST /api/datasources/:datasourceId/permissions`         `DELETE /datasources/:datasourceId/permissions`         `POST /datasources/:datasourceId/enable-permissions`         `POST /datasources/:datasourceId/disable-permissions`
        - Please use the following endpoints instead:
          `GET /api/access-control/datasources/:uid` for listing data            source permissions           `POST /api/access-control/datasources/:uid/users/:id`,           `POST /api/access-control/datasources/:uid/teams/:id` and           `POST /api/access-control/datasources/:uid/buildInRoles/:id`           for adding or removing data source permissions
      * If you are using Terraform Grafana provider to manage data source permissions, you will need to     upgrade your         provider.
      * For the existing backend mode users who have table visualization might see some inconsistencies on     their panels.
        We have updated the table column naming. This will potentially affect field transformations and/or     field overrides.
      * The deprecated `/playlists/{uid}/dashboards` API endpoint has been removed.
        Dashboard information can be retrieved from the `/dashboard/...` APIs.
      * The `PUT /api/folders/:uid` endpoint no more supports modifying the folder's `UID`
      * Removed all components for the old panel header design.
      * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-3/         for more details
      * OAuth role mapping enforcement: This change impacts GitHub,         Gitlab, Okta, and Generic OAuth. To avoid overriding manually         set roles, enable the skip_org_role_sync option in the         Grafana configuration for your OAuth provider before         upgrading
      * Angular has been deprecated
      * Grafana legacy alerting has been deprecated
      * API keys are migrating to service accounts
      * The experimental dashboard previews feature is removed
      * Usernames are now case-insensitive by default
      * Grafana OAuth integrations do not work anymore with email lookups
      * The Alias field in the CloudWatch data source is removed
      * Athena data source plugin must be updated to version >=2.9.3
      * Redshift data source plugin must be updated to version >=1.8.3
      * DoiT International BigQuery plugin no longer supported
      * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-0         for more details

    - This update brings many new features, enhancements and fixes highlighted at:
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-4/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-3/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-2/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-1/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-0/:

    spacecmd was updated to version 5.0.11-0:

    - Updated translation strings

    supportutils-plugin-salt was updated to version 1.2.3:

    - Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)
    - Provide backwards-compatible scripts version

    supportutils-plugin-susemanager-client was updated to version 5.0.4-0:

    - Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)

    uyuni-tools was updated from version 0.1.23-0 to 0.1.27-0:

    - Security issues fixed:
      * CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Grafana Labs installed on the remote host is prior to 10.3.10, 10.4.9, 11.0.5, 11.1.6, or 11.2.1. It is, therefore, affected by a vulnerability as referenced in the cve-2024-8118 advisory.

  - In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with     permission to write external alert instances to also write alert rules. (CVE-2024-8118)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114834	Grafana 11.2.x < 11.2.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114833	Grafana 11.1.x < 11.1.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114832	Grafana 11.0.x < 11.0.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114831	Grafana 10.4.x < 10.4.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114830	Grafana 10.3.x < 10.3.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
231753	Linux Distros Unpatched Vulnerability : CVE-2024-8118	Nessus	Misc.	medium
216397	SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:0545-1)	Nessus	SuSE Local Security Checks	medium
216389	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2025:0525-1)	Nessus	SuSE Local Security Checks	medium
208027	Grafana Labs Incorrect Permission (cve-2024-8118)	Nessus	Web Servers	medium

Detections

Analytics

CVE-2024-8118

medium

Tenable Plugins

critical

critical

critical

critical

critical

medium

medium

medium

medium