CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2025-3415
Medium (4.3). EPSS 1.1% chance of exploitation in the next 30 days. Fixed in github.com/grafana/grafana 1.9.2-0.20250514160932-04111e9f2afd.
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission.
Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-46m5-8hpj-p5p5 | Go | github.com/grafana/grafana | <1.9.2-0.20250514160932-04111e9f2afd | 1.9.2-0.20250514160932-04111e9f2afd |
| GO-2025-3814 | Go | github.com/grafana/grafana | all versions | no fix published |