CVE-2025-3415 describes an information disclosure vulnerability in Grafana's Alerting DingDing integration, where sensitive API keys could be exposed to users with Viewer permissions. This medium-severity vulnerability (CVSS 4.3) has a low attack complexity and does not impact availability or integrity, but could lead to unauthorized access to DingDing. While there is no evidence of active exploitation, a Nuclei template exists for detecting the exposure. Community discussion and media coverage for this CVE are currently minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Grafana | Grafana | >= 10.4.x, < 10.4.19+security-01, >= 11.2.x, < 11.2.10+security-01, >= 11.3.x, < 11.3.7+security-01, >= 11.4.x, < 11.4.5+security-01, >= 11.5.x, < 11.5.5+security-01, >= 11.6.x, < 11.6.2+security-01, >= 12.0.x, < 12.0.1+security-01CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Grafana's insecure DingDing Alert integration exposes sensitive information
Jul 17, 2025Information Disclosure in DingDing Integration in Grafana
Jul 17, 2025Information Disclosure in DingDing Integration in Grafana
Jul 17, 2025Information Disclosure in DingDing Integration in Grafana
Jul 17, 2025Information Disclosure in DingDing Integration in Grafana
Jul 17, 2025Information Disclosure in DingDing Integration in Grafana
Jul 17, 2025Information Disclosure in DingDing Integration in Grafana
Jul 17, 2025grafana: Exposure of DingDing alerting integration URL to Viewer level users
Jun 24, 2025