CVE-2025-3415

MEDIUM EXPLOITED NUCLEI

Grafana 10.4.x-12.0.x Unauthorized Sensitive Information Exposure via DingDing Alerting

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-3415 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

Nuclei Templates (1)

Grafana - Exposes DingDing API Keys
MEDIUMVERIFIEDby lucasribolli
Shodan: http.title:"grafana" || cpe:"cpe:2.3:a:grafana:grafana"
FOFA: title="grafana" || app="grafana"

References (1)

Core 1
Core References

Scores

CVSS v3 4.3
EPSS 0.0044
EPSS Percentile 63.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2025-08-07
CWE
CWE-200
Status published
Products (8)
grafana/grafana 0 - 1.9.2-0.20250514160932-04111e9f2afdGo
Grafana/Grafana 10.4.x - 10.4.19+security-01
Grafana/Grafana 11.2.x - 11.2.10+security-01
Grafana/Grafana 11.3.x - 11.3.7+security-01
Grafana/Grafana 11.4.x - 11.4.5+security-01
Grafana/Grafana 11.5.x - 11.5.5+security-01
Grafana/Grafana 11.6.x - 11.6.2+security-01
Grafana/Grafana 12.0.x - 12.0.1+security-01
Published Jul 17, 2025
Tracked Since Feb 18, 2026