摘要:
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
安全等级: Low
公告ID: KylinSec-SA-2024-4034
发布日期: 2024年10月25日
关联CVE: CVE-2024-6322
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2024-6322 | KY3.4-5A | grafana | Unaffected |
| CVE-2024-6322 | KY3.5.2 | grafana | Unaffected |
| CVE-2024-6322 | V6 | grafana | Unaffected |
