CVE-2025-3454

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3454", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2025-04-08T20:40:44.631Z", "datePublished": "2025-06-02T10:34:09.254Z", "dateUpdated": "2025-06-02T12:04:24.348Z"}, "containers": {"cna": {"affected": [{"product": "Grafana", "vendor": "Grafana", "versions": [{"lessThan": "11.6.0+security-01", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThan": "11.5.3+security-01", "status": "affected", "version": "11.5.0", "versionType": "semver"}, {"lessThan": "11.4.3+security-01", "status": "affected", "version": "11.4.0", "versionType": "semver"}, {"lessThan": "11.3.5+security-01", "status": "affected", "version": "11.3.0", "versionType": "semver"}, {"lessThan": "11.2.8+security-01", "status": "affected", "version": "11.2.0", "versionType": "semver"}, {"lessThan": "10.4.17+security-01", "status": "affected", "version": "10.4.0", "versionType": "semver"}]}, {"product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThan": "11.6.0+security-01", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThan": "11.5.3+security-01", "status": "affected", "version": "11.5.0", "versionType": "semver"}, {"lessThan": "11.4.3+security-01", "status": "affected", "version": "11.4.0", "versionType": "semver"}, {"lessThan": "11.3.5+security-01", "status": "affected", "version": "11.3.0", "versionType": "semver"}, {"lessThan": "11.2.8+security-01", "status": "affected", "version": "11.2.0", "versionType": "semver"}, {"lessThan": "10.4.17+security-01", "status": "affected", "version": "10.4.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.</p><p>Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.</p><p>The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.</p>"}], "value": "This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.\n\nUsers with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.\n\nThe issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources."}], "impacts": [{"capecId": "CAPEC-129", "descriptions": [{"lang": "en", "value": "CAPEC-129"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "description": "CWE-285", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2025-06-02T10:34:09.254Z"}, "references": [{"url": "https://grafana.com/security/security-advisories/cve-2025-3454/"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-02T12:03:59.158063Z", "id": "CVE-2025-3454", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T12:04:24.348Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3454", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-02T12:03:59.158063Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T12:04:17.633Z"}}], "cna": {"impacts": [{"capecId": "CAPEC-129", "descriptions": [{"lang": "en", "value": "CAPEC-129"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Grafana", "product": "Grafana", "versions": [{"status": "affected", "version": "11.6.0", "lessThan": "11.6.0+security-01", "versionType": "semver"}, {"status": "affected", "version": "11.5.0", "lessThan": "11.5.3+security-01", "versionType": "semver"}, {"status": "affected", "version": "11.4.0", "lessThan": "11.4.3+security-01", "versionType": "semver"}, {"status": "affected", "version": "11.3.0", "lessThan": "11.3.5+security-01", "versionType": "semver"}, {"status": "affected", "version": "11.2.0", "lessThan": "11.2.8+security-01", "versionType": "semver"}, {"status": "affected", "version": "10.4.0", "lessThan": "10.4.17+security-01", "versionType": "semver"}]}, {"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "11.6.0", "lessThan": "11.6.0+security-01", "versionType": "semver"}, {"status": "affected", "version": "11.5.0", "lessThan": "11.5.3+security-01", "versionType": "semver"}, {"status": "affected", "version": "11.4.0", "lessThan": "11.4.3+security-01", "versionType": "semver"}, {"status": "affected", "version": "11.3.0", "lessThan": "11.3.5+security-01", "versionType": "semver"}, {"status": "affected", "version": "11.2.0", "lessThan": "11.2.8+security-01", "versionType": "semver"}, {"status": "affected", "version": "10.4.0", "lessThan": "10.4.17+security-01", "versionType": "semver"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2025-3454/"}], "descriptions": [{"lang": "en", "value": "This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.\n\nUsers with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.\n\nThe issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.", "supportingMedia": [{"type": "text/html", "value": "<p>This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.</p><p>Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.</p><p>The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2025-06-02T10:34:09.254Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3454", "state": "PUBLISHED", "dateUpdated": "2025-06-02T12:04:24.348Z", "dateReserved": "2025-04-08T20:40:44.631Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2025-06-02T10:34:09.254Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Grafana", "vendor": "Grafana", "versions": [{"lessThan": "11.6.0+security-01", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThan": "11.5.3+security-01", "status": "affected", "version": "11.5.0", "versionType": "semver"}, {"lessThan": "11.4.3+security-01", "status": "affected", "version": "11.4.0", "versionType": "semver"}, {"lessThan": "11.3.5+security-01", "status": "affected", "version": "11.3.0", "versionType": "semver"}, {"lessThan": "11.2.8+security-01", "status": "affected", "version": "11.2.0", "versionType": "semver"}, {"lessThan": "10.4.17+security-01", "status": "affected", "version": "10.4.0", "versionType": "semver"}]}, {"product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThan": "11.6.0+security-01", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThan": "11.5.3+security-01", "status": "affected", "version": "11.5.0", "versionType": "semver"}, {"lessThan": "11.4.3+security-01", "status": "affected", "version": "11.4.0", "versionType": "semver"}, {"lessThan": "11.3.5+security-01", "status": "affected", "version": "11.3.0", "versionType": "semver"}, {"lessThan": "11.2.8+security-01", "status": "affected", "version": "11.2.0", "versionType": "semver"}, {"lessThan": "10.4.17+security-01", "status": "affected", "version": "10.4.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.\n\nUsers with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.\n\nThe issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources."}, {"lang": "es", "value": "Esta vulnerabilidad en la API de proxy de origen de datos de Grafana permite omitir las comprobaciones de autorizaci\u00f3n a\u00f1adiendo una barra diagonal adicional en la ruta URL. Los usuarios con permisos m\u00ednimos podr\u00edan obtener acceso de lectura no autorizado a los endpoints GET en los or\u00edgenes de datos de Alertmanager y Prometheus. El problema afecta principalmente a los or\u00edgenes de datos que implementan permisos espec\u00edficos de ruta, como Alertmanager y algunos or\u00edgenes de datos basados en Prometheus."}], "id": "CVE-2025-3454", "lastModified": "2026-06-17T09:19:58.910", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3454", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-02T12:03:59.158063Z", "version": "2.0.3"}}]}, "published": "2025-06-02T11:15:22.167", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2025-3454/"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: Unauthorized Data Source Access in Grafana via URL Path Manipulation", "id": "2358581", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2358581"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.\nUsers with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.\nThe issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.", "A vulnerability was found in Grafana's data source proxy API, which allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alert manager and Prometheus data sources. The issue primarily affects data sources that implement route-specific permissions, including Alert manager and certain Prometheus-based data sources."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-3454", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-04-23T09:55:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-3454\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-3454"], "statement": "This vulnerability is classified as a Moderate severity as it allows users with minimal permissions, including Viewer role, to bypass route-specific authorization checks in Grafana\u2019s data source proxy API. By appending an extra slash to the URL path, a user may gain unauthorized read-only access to endpoints in data sources such as Alertmanager and certain Prometheus-based integrations. Although the issue does not permit data modification or deletion, it undermines expected access controls and may lead to unintended exposure of monitoring data.\nThis issue affects Grafana versions 10.4.0 and later, which are not part of any Red Hat supported distributions. As such, Red Hat customers are not affected by this vulnerability.", "threat_severity": "Moderate"}

{"created": "2025-06-24T09:44:20.537612+00:00", "updated": "2025-06-24T09:44:20.537660+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana"]}