Threat database

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it  could result in  the wrong user identifier being used, and information for which the viewer is not authorized being returned.  This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0

EPSS 0.3%VulnerabilityGrafana Labs#cwe-653Germany+6

When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it  could result in  the wrong user identifier being used, and information for which the viewer is not authorized being returned.  This issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.

EPSS 0.3%VulnerabilityGrafana Labs#cwe-653Germany+6

CVE-2021-43798 is a path traversal vulnerability in Grafana that allows unauthorized access to local files. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.

EPSS 0.2%VulnerabilityGrafana Labs#cwe-266Germany+5

Grafana contains an authentication bypass vulnerability (CVE-2021-39226) that allows both authenticated and unauthenticated users to view and delete all snapshot data. This can lead to complete loss of snapshot data. The vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.