Information disclosure in grafana-plugin-sdk-go - CVE-2024-8986
Published: September 21, 2024
Vulnerability identifier: #VU97634
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-8986
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the Grafana plugin SDK bundles build metadata into the binaries it compiles. This metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.
Affected software
grafana-plugin-sdk-go
IBM Security QRadar Log Management AQL Plugin
IBM Security QRadar Log Management AQL Plugin
How to mitigate CVE-2024-8986
Install updates from vendor's website.
grafana-plugin-sdk-go - update to 0.250.0
IBM Security QRadar Log Management AQL Plugin - update to 1.1.1
IBM Security QRadar Log Management AQL Plugin - update to 1.1.1