CPE Details
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:a:grafana:grafana:11.0.0:*:*:*:*:*:*:*
Informations
Vendor
grafanaProduct
grafanaVersion
11.0.0Related CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
| The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. | 9.4 |
Critical |
2025©
tesweb SA
