CVE-2024-8996

Grafana Agent Flow on Windows Unquoted service path

CVSS 7.3 HIGHEPSS 0.3%CWE-428

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.3EPSS 0.3%KEV nãoPoC —Patch —

Lifecycle

25 Sep 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Agent Flow: before 0.43.2

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

Grafana · Agent Flow

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/grafana/agent/releases/tag/v0.43.3 https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996/https://grafana.com/security/security-advisories/cve-2024-8996/