Information disclosure in grafana-plugin-sdk-go - CVE-2024-8986
Published: September 21, 2024
Vulnerability identifier: #VU97634
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-8986
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Grafana Labs
Affected software:
grafana-plugin-sdk-go
grafana-plugin-sdk-go
Detailed vulnerability description
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the Grafana plugin SDK bundles build metadata into the binaries it compiles. This metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.
How to mitigate CVE-2024-8986
Install updates from vendor's website.