#VU97634 Information disclosure in grafana-plugin-sdk-go - CVE-2024-8986
Published: September 21, 2024
Vulnerability identifier: #VU97634
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-8986
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
grafana-plugin-sdk-go
grafana-plugin-sdk-go
Software vendor:
Grafana Labs
Grafana Labs
Description
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the Grafana plugin SDK bundles build metadata into the binaries it compiles. This metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.
Remediation
Install updates from vendor's website.