Vulnerability · Published Jul 17, 2025 · Assigned by GRAFANA

CVE-2025-3415

Medium 4.3

In plain English

A medium-severity information exposure in Grafana from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)1.1%top 34.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/grafana/grafana	1.9.2-0.20250514160932-04111e9f2afd	GHSA-46m5-8hpj-p5p5
Go	github.com/grafana/grafana	no fix listed	GO-2025-3814

Affected products (as reported)

Vendor	Product	Versions
Grafana	Grafana	10.4.x – before 10.4.19+security-0111.2.x – before 11.2.10+security-0111.3.x – before 11.3.7+security-0111.4.x – before 11.4.5+security-0111.5.x – before 11.5.5+security-0111.6.x – before 11.6.2+security-0112.0.x – before 12.0.1+security-01

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://grafana.com/security/security-advisories/cve-2025-3415 vendor-advisory