CVE-2024-8986: Grafana plugin SDK Information Leakage
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.
Published Sep 19, 2024 · Updated Nov 20, 2024
Affected packages
github.com/grafana/grafana-plugin-sdk-go
- Ecosystem
- Go
- Affected
- <= 0.249.0
- Fixed in
- 0.250.0
- Check
go list -m github.com/grafana/grafana-plugin-sdk-go
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin.
If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology