5.0
Moyenne
CVE-2025-3454 This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash…
Description
This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| grafana 11.6 | premières → < 11.6.0+security-01 | 11.6.0+security-01 |
| grafana 11.5 | 11.5.0 → < 11.5.3+security-01 | 11.5.3+security-01 |
| grafana 11.4 | 11.4.0 → < 11.4.3+security-01 | 11.4.3+security-01 |
| grafana 11.3 | 11.3.0 → < 11.3.5+security-01 | 11.3.5+security-01 |
| grafana 11.2 | 11.2.0 → < 11.2.8+security-01 | 11.2.8+security-01 |
| grafana 10.4 | 10.4.0 → < 10.4.17+security-01 | 10.4.17+security-01 |
| Grafana Enterprise 11.6 | premières → < 11.6.0+security-01 | 11.6.0+security-01 |
| Grafana Enterprise 11.5 | 11.5.0 → < 11.5.3+security-01 | 11.5.3+security-01 |
| Grafana Enterprise 11.4 | 11.4.0 → < 11.4.3+security-01 | 11.4.3+security-01 |
Afficher les 3 autres branches Masquer les 3 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Grafana Enterprise 11.3 | 11.3.0 → < 11.3.5+security-01 | 11.3.5+security-01 |
| Grafana Enterprise 11.2 | 11.2.0 → < 11.2.8+security-01 | 11.2.8+security-01 |
| Grafana Enterprise 10.4 | 10.4.0 → < 10.4.17+security-01 | 10.4.17+security-01 |
Autres CVE de grafana
Les 59 CVE de grafana →
CVE-2026-27879
A resample query can be used to trigger out-of-memory crashes in Grafana
6.5
Moyenne
CVE-2026-28375
A testdata data-source can be used to trigger out-of-memory crashes in Grafana
6.5
Moyenne
CVE-2026-27876
RCE on Grafana via sqlExpressions
9.1
Critique
CVE-2026-27880
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory…
7.5
Élevée