CVE-2024-10452 - Vulnerability Details - OpenCVE

Organization admins can delete pending invites created in an organization they are not part of.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Grafana	Grafana

Configuration 1 [-]

cpe:2.3:a:grafana:grafana:10.4.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://grafana.com/security/security-advisories/cve-2024-10452
https://nvd.nist.gov/vuln/detail/CVE-2024-10452
https://www.cve.org/CVERecord?id=CVE-2024-10452

History

Tue, 15 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00036}`	epss `{'score': 0.00042}`

Fri, 08 Nov 2024 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Grafana Grafana grafana
CPEs		cpe:2.3:a:grafana:grafana:10.4.0:::::::*
Vendors & Products		Grafana Grafana grafana

Wed, 30 Oct 2024 01:45:00 +0000

Type	Values Removed	Values Added
Title		grafana: Org admin can delete pending invites in different org
References		https://nvd.nist.gov/vuln/detail/CVE-2024-10452 https://www.cve.org/CVERecord?id=CVE-2024-10452
Metrics	threat_severity `None`	threat_severity `Low`

Tue, 29 Oct 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 29 Oct 2024 15:30:00 +0000

Type	Values Removed	Values Added
Description		Organization admins can delete pending invites created in an organization they are not part of.
Weaknesses		CWE-639
References		https://grafana.com/security/security-advisories/cve-2024-10452
Metrics		cvssV3_1 `{'score': 2.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published: 2024-10-29T15:16:22.405Z

Updated: 2024-10-29T15:35:35.167Z

Reserved: 2024-10-28T09:08:31.193Z

Link: CVE-2024-10452

Vulnrichment

Updated: 2024-10-29T15:35:32.142Z

NVD

Status : Analyzed

Published: 2024-10-29T16:15:04.593

Modified: 2024-11-08T17:59:10.977

Link: CVE-2024-10452

Redhat

Severity : Low

Publid Date: 2024-10-29T15:16:22Z

Links: CVE-2024-10452 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10452", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2024-10-28T09:08:31.193Z", "datePublished": "2024-10-29T15:16:22.405Z", "dateUpdated": "2024-10-29T15:35:35.167Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana", "vendor": "Grafana", "versions": [{"status": "affected", "version": "10.4.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Organization admins can delete pending invites created in an organization they are not part of."}], "value": "Organization admins can delete pending invites created in an organization they are not part of."}], "impacts": [{"capecId": "CAPEC-109", "descriptions": [{"lang": "en", "value": "CAPEC-109 Object Relational Mapping Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2024-10-29T15:16:22.405Z"}, "references": [{"url": "https://grafana.com/security/security-advisories/cve-2024-10452"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-29T15:35:24.824806Z", "id": "CVE-2024-10452", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T15:35:35.167Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10452", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-29T15:35:24.824806Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T15:35:32.142Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-109", "descriptions": [{"lang": "en", "value": "CAPEC-109 Object Relational Mapping Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Grafana", "product": "Grafana", "versions": [{"status": "affected", "version": "10.4.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2024-10452"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Organization admins can delete pending invites created in an organization they are not part of.", "supportingMedia": [{"type": "text/html", "value": "Organization admins can delete pending invites created in an organization they are not part of.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2024-10-29T15:16:22.405Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10452", "state": "PUBLISHED", "dateUpdated": "2024-10-29T15:35:35.167Z", "dateReserved": "2024-10-28T09:08:31.193Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2024-10-29T15:16:22.405Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.1"}