CVE-2025-3415

Aliases:GHSA-46m5-8hpj-p5p5BIT-grafana-2025-3415GO-2025-3814
Advisory lineage Upstream: 0 Downstream: 12
Deferred
Published: 17 Jul 2025, 10:13
Last modified:17 Jul 2025, 14:05

Vulnerability Summary

Overall Risk (default)
low
17/100
CVSS Score
4.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.44% LOW
0% probability +0.11%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

17 Jul 2025, 10:13
Published
Vulnerability first disclosed
17 Jul 2025, 14:05
Last Modified
Vulnerability information updated

Description

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 0.44%• Percentile: 63%

Techniques & Countermeasures

  • CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

    The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Systems

  • github.com/grafana•grafana

    < 1.9.2-0.20250514160932-04111e9f2afd | all

  • grafana•grafana

    ≥ 10.4.x, < 10.4.19+security-01 | ≥ 11.2.x, < 11.2.10+security-01 | ≥ 11.3.x, < 11.3.7+security-01 | ≥ 11.4.x, < 11.4.5+security-01 | ≥ 11.5.x, < 11.5.5+security-01 | ≥ 11.6.x, < 11.6.2+security-01 | ≥ 12.0.x, < 12.0.1+security-01

References (12)