{
  "cveId": "CVE-2024-1313",
  "url": "https://patchblox.com/security/cve/CVE-2024-1313",
  "summary": "CVE-2024-1313 is fixed in 3 products on 1 platform, first by RHSA-2024:2568, released April 30, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "grafana: This update for grafana and mybatis fixes the following issues:\n\ngrafana was updated to version 9.5.18:\n\n- Grafana no...",
  "description": "This update for grafana and mybatis fixes the following issues:\n\ngrafana was updated to version 9.5.18:\n\n- Grafana now requires Go 1.20\n- Security issues fixed:\n\n  * CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)\n  * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)\n\n- Other non-security related changes:\n\n  * Version 9.5.17:\n\n    \u002B [FEATURE] Alerting: Backport use Alertmanager API v2\n\n  * Version 9.5.16:\n\n    \u002B [BUGFIX] Annotations: Split cleanup into separate queries and\n      deletes to avoid deadlocks on MySQL\n\n  * Version 9.5.15:\n\n    \u002B [FEATURE] Alerting: Attempt to retry retryable errors\n\n  * Version 9.5.14:\n\n    \u002B [BUGFIX] Alerting: Fix state manager to not keep\n      datasource_uid and ref_id labels in state after Error\n    \u002B [BUGFIX] Transformations: Config overrides being lost when\n      config from query transform is applied\n    \u002B [BUGFIX] LDAP: Fix enable users on successfull login\n\n  * Version 9.5.13:\n\n    \u002B [BUGFIX] BrowseDashboards: Only remember the most recent\n      expanded folder\n    \u002B [BUGFIX] Licensing: Pass func to update env variables when\n      starting plugin\n\n  * Version 9.5.12:\n\n    \u002B [FEATURE] Azure: Add support for Workload Identity\n      authentication\n\n  * Version 9.5.9:\n\n    \u002B [FEATURE] SSE: Fix DSNode to not panic when response has empty\n      response\n    \u002B [FEATURE] Prometheus: Handle the response with different field\n      key order\n    \u002B [BUGFIX] LDAP: Fix user disabling\n\n\nmybatis:\n\n- \u0060apache-commons-ognl\u0060 is now a non-optional dependency\n- Fixed building with log4j v1 and v2 dependencies",
  "published": "2024-04-30T00:00:00Z",
  "severity": "Important",
  "cvss": 6.5,
  "epss": 0.00646,
  "epssPercentile": 0.51217,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "grafana",
      "release": "RHEL 8",
      "fixedVersion": "0:9.2.10-16.el8_10",
      "fix": "RHSA-2024:3265",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2024-3265",
      "released": "2024-05-22T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "RHEL 9",
      "fixedVersion": "0:9.2.10-16.el9_4",
      "fix": "RHSA-2024:2568",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2024-2568",
      "released": "2024-04-30T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "almalinux 8",
      "fixedVersion": "9.2.10-16.el8_10",
      "fix": "ALSA-2024:3265",
      "url": "https://patchblox.com/security/fix/linux/alsa-2024-3265",
      "released": "2024-05-22T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "almalinux 9",
      "fixedVersion": "9.2.10-16.el9_4.alma.1",
      "fix": "ALSA-2024:2568",
      "url": "https://patchblox.com/security/fix/linux/alsa-2024-2568",
      "released": "2024-04-30T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "ol 8",
      "fixedVersion": "0:9.2.10-16.el8_10",
      "fix": "ELSA-2024-3265",
      "url": "https://patchblox.com/security/fix/linux/elsa-2024-3265",
      "released": "2024-05-29T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "ol 9",
      "fixedVersion": "0:9.2.10-16.el9_4",
      "fix": "ELSA-2024-2568",
      "url": "https://patchblox.com/security/fix/linux/elsa-2024-2568",
      "released": "2024-05-07T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "9.5.18-150200.3.56.1",
      "fix": "SUSE-SU-2024:1530-2",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1530-2",
      "released": "2024-06-24T16:19:43Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "rocky 8",
      "fixedVersion": "0:9.2.10-16.el8_10",
      "fix": "RLSA-2024:3265",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2024-3265",
      "released": "2024-06-14T13:59:30Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "rocky 9",
      "fixedVersion": "0:9.2.10-16.el9_4",
      "fix": "RLSA-2024:2568",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2024-2568",
      "released": "2024-05-10T14:32:42Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "sles 15.6",
      "fixedVersion": "9.5.18-150200.3.56.1",
      "fix": "SUSE-SU-2024:1530-2",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1530-2",
      "released": "2024-06-24T16:19:43Z"
    },
    {
      "platform": "linux",
      "product": "grafana-selinux",
      "release": "RHEL 8",
      "fixedVersion": "0:9.2.10-16.el8_10",
      "fix": "RHSA-2024:3265",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2024-3265",
      "released": "2024-05-22T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana-selinux",
      "release": "RHEL 9",
      "fixedVersion": "0:9.2.10-16.el9_4",
      "fix": "RHSA-2024:2568",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2024-2568",
      "released": "2024-04-30T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana-selinux",
      "release": "almalinux 8",
      "fixedVersion": "9.2.10-16.el8_10",
      "fix": "ALSA-2024:3265",
      "url": "https://patchblox.com/security/fix/linux/alsa-2024-3265",
      "released": "2024-05-22T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana-selinux",
      "release": "almalinux 9",
      "fixedVersion": "9.2.10-16.el9_4.alma.1",
      "fix": "ALSA-2024:2568",
      "url": "https://patchblox.com/security/fix/linux/alsa-2024-2568",
      "released": "2024-04-30T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana-selinux",
      "release": "ol 8",
      "fixedVersion": "0:9.2.10-16.el8_10",
      "fix": "ELSA-2024-3265",
      "url": "https://patchblox.com/security/fix/linux/elsa-2024-3265",
      "released": "2024-05-29T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana-selinux",
      "release": "ol 9",
      "fixedVersion": "0:9.2.10-16.el9_4",
      "fix": "ELSA-2024-2568",
      "url": "https://patchblox.com/security/fix/linux/elsa-2024-2568",
      "released": "2024-05-07T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "mybatis",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "3.5.6-150200.5.6.1",
      "fix": "SUSE-SU-2024:1530-2",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1530-2",
      "released": "2024-06-24T16:19:43Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}