Vulnerability-Lookup

CVE-2025-3415 (GCVE-0-2025-3415)

Vulnerability from cvelistv5 – Published: 2025-07-17 10:13 – Updated: 2025-07-17 14:05

Previdian

Summary

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Automatable: No Exploitation: None Technical Impact: None Value Density: Diffused

GRAFANA

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-17 14:05 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GRAFANA mitre root Scorecard

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana	Affected: 10.4.x , < 10.4.19+security-01 (semver) Affected: 11.2.x , < 11.2.10+security-01 (semver) Affected: 11.3.x , < 11.3.7+security-01 (semver) Affected: 11.4.x , < 11.4.5+security-01 (semver) Affected: 11.5.x , < 11.5.5+security-01 (semver) Affected: 11.6.x , < 11.6.2+security-01 (semver) Affected: 12.0.x , < 12.0.1+security-01 (semver)

Credits

Saurabh Banawar

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: dbd0b3f5-350b-443a-b8bb-c5210ed4fb1b

Vulnerability ID: CVE-2025-3415

Status: Confirmed

Status Updated: 2025-07-17 12:13 CEST

Exploited: Yes

Timestamps

First Seen: 2025-07-17

Asserted: 2025-07-17

Scope

Notes: Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could... | Affected: Grafana / Grafana | CVSS: 4.3 (MEDIUM) | EPSS: 0.00983 | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could...
Cve Id	CVE-2025-3415
Vendor	Grafana
Ghsa Id	GHSA-46M5-8HPJ-P5P5
Product	Grafana
Added Date	2025-07-17T10:13:14.000Z
Cvss Score	4.3
Epss Score	0.00983
Previous Ids
Cvss Severity	MEDIUM
Virtual Patch	False
Cvss Estimated	False
Epss Percentile	0.6094
Used In Malware	unknown
Vulnerability Id	CVE-2025-3415
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-10-02 09:10 CEST | Updated: 2026-10-02 09:10 CEST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3415",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-17T14:05:03.257904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-17T14:05:19.284Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "10.4.19+security-01",
              "status": "affected",
              "version": "10.4.x",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.10+security-01",
              "status": "affected",
              "version": "11.2.x",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.7+security-01",
              "status": "affected",
              "version": "11.3.x",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.5+security-01",
              "status": "affected",
              "version": "11.4.x",
              "versionType": "semver"
            },
            {
              "lessThan": "11.5.5+security-01",
              "status": "affected",
              "version": "11.5.x",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.2+security-01",
              "status": "affected",
              "version": "11.6.x",
              "versionType": "semver"
            },
            {
              "lessThan": "12.0.1+security-01",
              "status": "affected",
              "version": "12.0.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Saurabh Banawar"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \u003cbr\u003eFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01"
            }
          ],
          "value": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "Automatable": "No",
              "Exploitation": "None",
              "Technical Impact": "None",
              "Value Density": "Diffused"
            },
            "type": "SSVCv2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-17T10:30:00.918Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2025-3415"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2025-3415",
    "datePublished": "2025-07-17T10:13:14.717Z",
    "dateReserved": "2025-04-07T14:28:18.797Z",
    "dateUpdated": "2025-07-17T14:05:19.284Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-3415",
      "date": "2026-10-01",
      "epss": "0.00983",
      "percentile": "0.6094"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Grafana",
                "vendor": "Grafana",
                "versions": [
                  {
                    "lessThan": "10.4.19+security-01",
                    "status": "affected",
                    "version": "10.4.x",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "11.2.10+security-01",
                    "status": "affected",
                    "version": "11.2.x",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "11.3.7+security-01",
                    "status": "affected",
                    "version": "11.3.x",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "11.4.5+security-01",
                    "status": "affected",
                    "version": "11.4.x",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "11.5.5+security-01",
                    "status": "affected",
                    "version": "11.5.x",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "11.6.2+security-01",
                    "status": "affected",
                    "version": "11.6.x",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "12.0.1+security-01",
                    "status": "affected",
                    "version": "12.0.x",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@grafana.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01"
          },
          {
            "lang": "es",
            "value": "Grafana es una plataforma de c\u00f3digo abierto para la monitorizaci\u00f3n y la observabilidad. La integraci\u00f3n de Grafana Alerting DingDing no estaba debidamente protegida y pod\u00eda estar expuesta a usuarios con permiso de Visualizador. Corregido en las versiones 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 y 12.0.1+security-01."
          }
        ],
        "id": "CVE-2025-3415",
        "lastModified": "2026-06-17T09:19:55.240",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "security@grafana.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-3415",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-17T14:05:03.257904Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-07-17T11:15:22.240",
        "references": [
          {
            "source": "security@grafana.com",
            "url": "https://grafana.com/security/security-advisories/cve-2025-3415"
          }
        ],
        "sourceIdentifier": "security@grafana.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              }
            ],
            "source": "security@grafana.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-11T17:42:33+00:00",
      "cve": "CVE-2025-3415",
      "id": "CVE-2025-3415",
      "initial_release_date": "2025-06-24T00:00:00+00:00",
      "product_status:known_not_affected": "21",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "grafana: Exposure of DingDing alerting integration URL to Viewer level users",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-3415.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-3415",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-07-17T14:05:03.257904Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-07-17T14:05:09.376Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Grafana",
              "vendor": "Grafana",
              "versions": [
                {
                  "lessThan": "10.4.19+security-01",
                  "status": "affected",
                  "version": "10.4.x",
                  "versionType": "semver"
                },
                {
                  "lessThan": "11.2.10+security-01",
                  "status": "affected",
                  "version": "11.2.x",
                  "versionType": "semver"
                },
                {
                  "lessThan": "11.3.7+security-01",
                  "status": "affected",
                  "version": "11.3.x",
                  "versionType": "semver"
                },
                {
                  "lessThan": "11.4.5+security-01",
                  "status": "affected",
                  "version": "11.4.x",
                  "versionType": "semver"
                },
                {
                  "lessThan": "11.5.5+security-01",
                  "status": "affected",
                  "version": "11.5.x",
                  "versionType": "semver"
                },
                {
                  "lessThan": "11.6.2+security-01",
                  "status": "affected",
                  "version": "11.6.x",
                  "versionType": "semver"
                },
                {
                  "lessThan": "12.0.1+security-01",
                  "status": "affected",
                  "version": "12.0.x",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Saurabh Banawar"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \u003cbr\u003eFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01"
                }
              ],
              "value": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "other": {
                "content": {
                  "Automatable": "No",
                  "Exploitation": "None",
                  "Technical Impact": "None",
                  "Value Density": "Diffused"
                },
                "type": "SSVCv2.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-200",
                  "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-07-17T10:30:00.918Z",
            "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
            "shortName": "GRAFANA"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://grafana.com/security/security-advisories/cve-2025-3415"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "assignerShortName": "GRAFANA",
        "cveId": "CVE-2025-3415",
        "datePublished": "2025-07-17T10:13:14.717Z",
        "dateReserved": "2025-04-07T14:28:18.797Z",
        "dateUpdated": "2025-07-17T14:05:19.284Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2025-08873 (CVE-2025-3415)

Vulnerability from fstec – Published: 2025-07-23 – Updated: 2025-08-01 – View on bdu.fstec.ru Fixed

Previdian

Title

Уязвимость службы оповещения Alerts & IRM платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю раскрыть защищаемую информацию

Summary

Уязвимость службы оповещения Alerts & IRM платформы для мониторинга и наблюдения Grafana связана с недостаточной защитой служебных данных при подключении к контактной точке DingDing. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, раскрыть защищаемую информацию

Severity

4.0 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Information gathering

Incidents

Being clarified

Remediation

Software update

CWE

CWE-200 - Раскрытие информации

Aliases

CVE-2025-3415

References

2 references

URL
https://grafana.com/security/security-advisories/cve-2025-3415/
https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti…

Impacted products

2 products from 2 vendors

Vendors

ООО «Ред Софт», Grafana Labs

Products

РЕД ОС (запись в едином реестре российских программ №3751), Grafana

Versions

7.3 (РЕД ОС), до 10.4.19+security-01 (Grafana), до 11.2.10+security-01 (Grafana), до 11.3.7+security-01 (Grafana), до 11.4.5+security-01 (Grafana), до 11.5.5+security-01 (Grafana), до 11.6.2+security-01 (Grafana), до 12.0.1+security-01 (Grafana)

Product types

Operating system, Application software

Platforms

ООО «Ред Софт» РЕД ОС 7.3 (запись в едином реестре российских программ №3751)

Mitigations

Использование рекомендаций производителя: https://grafana.com/security/security-advisories/cve-2025-3415/ Для РЕД ОС: https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-grafana-cve-2025-6023-cve-2025-3415-cve-2025-6197/?sphrase_id=1154489

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, Grafana Labs",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7.3 (\u0420\u0415\u0414 \u041e\u0421), \u0434\u043e 10.4.19+security-01 (Grafana), \u0434\u043e 11.2.10+security-01 (Grafana), \u0434\u043e 11.3.7+security-01 (Grafana), \u0434\u043e 11.4.5+security-01 (Grafana), \u0434\u043e 11.5.5+security-01 (Grafana), \u0434\u043e 11.6.2+security-01 (Grafana), \u0434\u043e 12.0.1+security-01 (Grafana)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://grafana.com/security/security-advisories/cve-2025-3415/\n\n\u0414\u043b\u044f \u0420\u0415\u0414 \u041e\u0421:\nhttps://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-grafana-cve-2025-6023-cve-2025-3415-cve-2025-6197/?sphrase_id=1154489",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "17.07.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "01.08.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "23.07.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-08873",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-3415",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "\u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Grafana",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043b\u0443\u0436\u0431\u044b \u043e\u043f\u043e\u0432\u0435\u0449\u0435\u043d\u0438\u044f Alerts \u0026 IRM \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f Grafana, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (CWE-200)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043b\u0443\u0436\u0431\u044b \u043e\u043f\u043e\u0432\u0435\u0449\u0435\u043d\u0438\u044f Alerts \u0026 IRM \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f Grafana \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043a \u043a\u043e\u043d\u0442\u0430\u043a\u0442\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 DingDing. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://grafana.com/security/security-advisories/cve-2025-3415/\nhttps://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-grafana-cve-2025-6023-cve-2025-3415-cve-2025-6197/?sphrase_id=1154489",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-200",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,3)"
}

bit-grafana-2025-3415

Vulnerability from bitnami_vulndb

Published

2025-07-22 05:41

Modified

2025-07-22 06:07

Summary

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "grafana",
        "purl": "pkg:bitnami/grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.4.0"
            },
            {
              "fixed": "10.4.19"
            },
            {
              "introduced": "11.2.0"
            },
            {
              "fixed": "11.6.2"
            },
            {
              "introduced": "12.0.0"
            },
            {
              "fixed": "12.0.1"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-3415"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:grafana:grafana:*:*:*:*:*:go:*:*"
    ],
    "severity": "Medium"
  },
  "details": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01",
  "id": "BIT-grafana-2025-3415",
  "modified": "2025-07-22T06:07:25.512Z",
  "published": "2025-07-22T05:41:15.588Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/cve-2025-3415"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3415"
    }
  ],
  "schema_version": "1.6.2"
}

CERTFR-2025-AVI-0515

Vulnerability from certfr_avis - Published: 2025-06-16 - Updated: 2025-06-16

Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Grafana Labs	Grafana	Grafana versions 11.2.x antérieures à 11.2.10
Grafana Labs	Grafana	Grafana versions antérieures à 10.4.19
Grafana Labs	Grafana	Grafana versions 12.0.x antérieures à 12.0.1
Grafana Labs	Grafana	Grafana versions 11.3.x antérieures à 11.3.7
Grafana Labs	Grafana	Grafana versions 11.4.x antérieures à 11.4.5
Grafana Labs	Grafana	Grafana versions 11.6.x antérieures à 11.6.2
Grafana Labs	Grafana	Grafana versions 11.5.x antérieures à 11.5.5

References

Title

Publication Time

EUVD-2026-247771

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 06:56

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T06:56:59.886732+00:00",
  "id": "EUVD-2026-247771"
}

FKIE_CVE-2025-3415

Vulnerability from fkie_nvd - Published: 2025-07-17 11:15 - Updated: 2026-06-17 09:19

Previdian

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security@grafana.com	https://grafana.com/security/security-advisories/cve-2025-3415

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "10.4.19+security-01",
              "status": "affected",
              "version": "10.4.x",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.10+security-01",
              "status": "affected",
              "version": "11.2.x",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.7+security-01",
              "status": "affected",
              "version": "11.3.x",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.5+security-01",
              "status": "affected",
              "version": "11.4.x",
              "versionType": "semver"
            },
            {
              "lessThan": "11.5.5+security-01",
              "status": "affected",
              "version": "11.5.x",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.2+security-01",
              "status": "affected",
              "version": "11.6.x",
              "versionType": "semver"
            },
            {
              "lessThan": "12.0.1+security-01",
              "status": "affected",
              "version": "12.0.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@grafana.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01"
    },
    {
      "lang": "es",
      "value": "Grafana es una plataforma de c\u00f3digo abierto para la monitorizaci\u00f3n y la observabilidad. La integraci\u00f3n de Grafana Alerting DingDing no estaba debidamente protegida y pod\u00eda estar expuesta a usuarios con permiso de Visualizador. Corregido en las versiones 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 y 12.0.1+security-01."
    }
  ],
  "id": "CVE-2025-3415",
  "lastModified": "2026-06-17T09:19:55.240",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security@grafana.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-3415",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-07-17T14:05:03.257904Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-07-17T11:15:22.240",
  "references": [
    {
      "source": "security@grafana.com",
      "url": "https://grafana.com/security/security-advisories/cve-2025-3415"
    }
  ],
  "sourceIdentifier": "security@grafana.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security@grafana.com",
      "type": "Secondary"
    }
  ]
}

GHSA-46M5-8HPJ-P5P5

Vulnerability from github – Published: 2025-07-17 12:30 – Updated: 2025-07-22 21:27

Summary

Grafana's insecure DingDing Alert integration exposes sensitive information

Details

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/grafana/grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.2-0.20250514160932-04111e9f2afd"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-3415"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-18T18:37:08Z",
    "nvd_published_at": "2025-07-17T11:15:22Z",
    "severity": "MODERATE"
  },
  "details": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01.",
  "id": "GHSA-46m5-8hpj-p5p5",
  "modified": "2025-07-22T21:27:05Z",
  "published": "2025-07-17T12:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3415"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grafana/grafana/commit/04111e9f2afd95ea3e5b01865cc29d3fc1198e71"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grafana/grafana/commit/0adb869188fa2b9ae26efd424b94e17189538f29"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grafana/grafana/commit/19c912476d4f7a81e8a3562668bc38f31b909e18"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grafana/grafana/commit/4144c636d1a6d0b17fafcf7a2c40fa403542202a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grafana/grafana/commit/4fc33647a8297d3a0aae04a5fcbac883ceb6a655"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grafana/grafana/commit/910eb1dd9e618014c6b1d2a99a431b99d4268c05"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grafana/grafana/commit/91327938626c9426e481e6294850af7b61415c98"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grafana/grafana/commit/a78de30720b4f33c88d0c1a973e693ebf3831717"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/grafana/grafana"
    },
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/cve-2025-3415"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grafana\u0027s insecure DingDing Alert integration exposes sensitive information"
}

OPENSUSE-SU-2025:15226-1

Vulnerability from csaf_opensuse - Published: 2025-07-03 00:00 - Updated: 2026-09-20 21:35

Summary

grafana-11.6.3-1.1 on GA media

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2025-3415.

CVE-2025-3415

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2025:15405-1

Vulnerability from csaf_opensuse - Published: 2025-08-04 00:00 - Updated: 2026-09-20 21:39

Summary

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media

Severity

Moderate

Scope

56 vulnerabilities in this advisory, including CVE-2025-3415.

CVE-2025-3415

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2026:20654-1

Vulnerability from csaf_opensuse - Published: 2026-04-29 16:12 - Updated: 2026-10-02 10:47

Summary

Security update for grafana

Severity

Critical

Scope

27 vulnerabilities in this advisory, including CVE-2025-3415.

CVE-2025-3415

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Recommended: 4 products

Open the full advisory

SCA-2026-0002

Vulnerability from csaf_sick - Published: 2026-01-15 14:00 - Updated: 2026-01-22 19:00

Summary

Vulnerabilities affecting SICK Incoming Goods Suite

Scope

12 vulnerabilities in this advisory, including CVE-2025-3415.

CVE-2025-3415

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fixed: 1 product Known affected: 1 product Recommended: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-3415 (GCVE-0-2025-3415)

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

BDU:2025-08873 (CVE-2025-3415)

Vulnerability from bitnami_vulndb

Solutions

Tags

Sightings

Nomenclature

Related by attack behaviour