CVE-2024-9264
SQL Expressions in Grafana allow attackers to execute commands and read files
Grafana’s SQL Expressions experimental feature contains a command injection and local file inclusion vulnerability. Any user with at least VIEWER permission can exploit it by sending malicious duckdb queries. Patches are available in Grafana 11.2.1, 11.1.6, and 11.0.5; proof-of-concept code exists but no active attacks are known.
Grafana · Updated 28 Oct · From the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 9.4 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Grafana 11.2 | 11.2.1 |
| Grafana 11.1 | 11.1.6 |
| Grafana 11.0 | 11.0.5 |
What to do
- Upgrade to Grafana 11.2.1, 11.1.6, or 11.0.5 as applicable.
What happened
- 23 OctRapid7 publishes Metasploit Wrap Up that includes this vulnerability.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2024-9264 | Grafana SQL Expressions allow for remote code execution | critical 9.4 | No | 98% |
Our reporting
We have not reported on it. It is here because the sources below did.
Reported elsewhere
Rapid7 · 23 OctMetasploit Wrap Up: Langflow, MongoDB, and More ↗The records
CVE-2024-9264 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works