Affected by GO-2022-0342
and 26 other vulnerabilities
GO-2022-0342: Grafana XSS in Dashboard Text Panel in github.com/grafana/grafana
GO-2024-2483: Grafana XSS via adding a link in General feature in github.com/grafana/grafana
GO-2024-2513: Grafana information disclosure in github.com/grafana/grafana
GO-2024-2515: Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana
GO-2024-2516: Grafana XSS via a column style in github.com/grafana/grafana
GO-2024-2517: Grafana XSS in header column rename in github.com/grafana/grafana
GO-2024-2519: Grafana world readable configuration files in github.com/grafana/grafana
GO-2024-2520: Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana
GO-2024-2523: Grafana stored XSS in github.com/grafana/grafana
GO-2024-2629: Grafana's users with permissions to create a data source can CRUD all data sources in github.com/grafana/grafana
GO-2024-2661: Arbitrary file read in github.com/grafana/grafana
GO-2024-2697: Grafana: Users outside an organization can delete a snapshot with its key in github.com/grafana/grafana
GO-2024-2843: Grafana Email addresses and usernames can not be trusted in github.com/grafana/grafana
GO-2024-2844: Grafana User enumeration via forget password in github.com/grafana/grafana
GO-2024-2847: Grafana Escalation from admin to server admin when auth proxy is used in github.com/grafana/grafana
GO-2024-2848: Grafana when using email as a username can block other users from signing in in github.com/grafana/grafana
GO-2024-2851: Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins in github.com/grafana/grafana
GO-2024-2852: Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana
GO-2024-2854: Grafana folders admin only permission privilege escalation in github.com/grafana/grafana
GO-2024-2855: Grafana Plugin signature bypass in github.com/grafana/grafana
GO-2024-2856: Grafana Race condition allowing privilege escalation in github.com/grafana/grafana
GO-2024-2857: Grafana Stored Cross-site Scripting in Unified Alerting in github.com/grafana/grafana
GO-2024-2858: Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins in github.com/grafana/grafana
GO-2024-2867: Grafana Spoofing originalUrl of snapshots in github.com/grafana/grafana
GO-2024-3079: Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana
GO-2024-3215: Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana
GO-2024-3240: Grafana org admin can delete pending invites in different org in github.com/grafana/grafana
type BackgroundService interface {
// Run starts the background process of the service after `Init` have been called// on all services. The `context.Context` passed into the function should be used// to subscribe to ctx.Done() so the service can be notified when Grafana shuts down.
Run(ctx context.Context) error
}
BackgroundService should be implemented for services that have
long running tasks in the background.
type CanBeDisabled interface {
// IsDisabled should return a bool saying if it can be started or not. IsDisabled() bool
}
CanBeDisabled allows the services to decide if it should
be started or not by itself. This is useful for services
that might not always be started, ex alerting.
This will be called after `Init()`.
type DatabaseMigrator interface {
// AddMigrations allows the service to add migrations to// the database migrator.
AddMigration(mg *migrator.Migrator)
}
DatabaseMigrator allows the caller to add migrations to
the migrator passed as argument
type Service interface {
// Init is called by Grafana main process which gives the service// the possibility do some initial work before its started. Things// like adding routes, bus handlers should be done in the Init function
Init() error
}
Service interface is the lowest common shape that services
are expected to forfill to be started within Grafana.