CVE-2024-8975highCWE-428

Grafana Alloy on Windows Unquoted service path

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.3%

exploitation probability

0.3%top 77% of all CVEs

observed exploitation

nono source reports it

Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

Grafana · Alloy

References

https://github.com/grafana/alloy/releases/tag/v1.3.4 https://github.com/grafana/alloy/releases/tag/v1.4.1 https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996/https://grafana.com/security/security-advisories/cve-2024-8975/