« Volver al listado

CVE-2025-3454

Estado: AplazadaMedia (5)—

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.

Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.

The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Grafana — GrafanaAIPrometheus — AlertmanagerAIPrometheus — PrometheusAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-3454",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-3454",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-02T12:03:59.158063Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@grafana.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security@grafana.com",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Grafana",
          "versions": [
            {
              "status": "affected",
              "version": "11.6.0",
              "lessThan": "11.6.0+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.5.0",
              "lessThan": "11.5.3+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.4.0",
              "lessThan": "11.4.3+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.3.0",
              "lessThan": "11.3.5+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.2.0",
              "lessThan": "11.2.8+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "10.4.0",
              "lessThan": "10.4.17+security-01",
              "versionType": "semver"
            }
          ]
        },
        {
          "vendor": "Grafana",
          "product": "Grafana Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "11.6.0",
              "lessThan": "11.6.0+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.5.0",
              "lessThan": "11.5.3+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.4.0",
              "lessThan": "11.4.3+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.3.0",
              "lessThan": "11.3.5+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.2.0",
              "lessThan": "11.2.8+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "10.4.0",
              "lessThan": "10.4.17+security-01",
              "versionType": "semver"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-06-02T11:15:22.167",
  "references": [
    {
      "url": "https://grafana.com/security/security-advisories/cve-2025-3454/",
      "source": "security@grafana.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@grafana.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.\n\nUsers with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.\n\nThe issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad en la API de proxy de origen de datos de Grafana permite omitir las comprobaciones de autorización añadiendo una barra diagonal adicional en la ruta URL. Los usuarios con permisos mínimos podrían obtener acceso de lectura no autorizado a los endpoints GET en los orígenes de datos de Alertmanager y Prometheus. El problema afecta principalmente a los orígenes de datos que implementan permisos específicos de ruta, como Alertmanager y algunos orígenes de datos basados en Prometheus."
    }
  ],
  "lastModified": "2026-06-17T09:19:58.910",
  "sourceIdentifier": "security@grafana.com"
}