Privilege Escalation Vulnerability in Grafana Alloy
CVE-2024-8975

7.8HIGH

Key Information:

Vendor
Grafana
Status
Alloy
Vendor
CVE Published:
25 September 2024

Summary

An unquoted search path vulnerability present in Grafana Alloy on Windows systems can enable a local user to escalate their privileges to that of the SYSTEM account. This issue affects Alloy versions prior to 1.3.3 and those from 1.4.0-rc.0 to 1.4.0-rc.1, exposing these versions to potential exploitation when proper path handling is not observed.

Affected Version(s)

Alloy Windows 0 < 1.3.3

Alloy Windows 1.4.0-rc.0 <= 1.4.0-rc.1

References

https://grafana.com/security/security-advisories/cve-2024...
https://grafana.com/blog/2024/09/25/grafana-alloy-and-gra...
https://github.com/grafana/alloy/releases/tag/v1.4.1

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.