« Volver al listado

CVE-2024-11741

Estado: AplazadaMedia (4.3)—

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3,  11.2.6, 11.1.11, 11.0.11 and 10.4.15

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Grafana — GrafanaAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-11741",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-11741",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-31T15:31:59.645050Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@grafana.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@grafana.com",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Grafana",
          "versions": [
            {
              "status": "affected",
              "version": "11.4.0",
              "lessThan": "11.4.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "11.3.0",
              "lessThan": "11.3.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "11.2.0",
              "lessThan": "11.2.6",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "11.1.0",
              "lessThan": "11.1.11",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.4.0",
              "lessThan": "10.4.15",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-01-31T16:15:30.853",
  "references": [
    {
      "url": "https://grafana.com/security/security-advisories/cve-2024-11741/",
      "source": "security@grafana.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20250509-0006/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@grafana.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3,  11.2.6, 11.1.11, 11.0.11 and 10.4.15"
    },
    {
      "lang": "es",
      "value": "Grafana es una plataforma de código abierto para monitoreo y observación. La integración de Grafana Alerting con VictorOps no estaba protegida adecuadamente y podía quedar expuesta a usuarios con permiso de Visualizador. Corregido en las versiones 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 y 10.4.15"
    }
  ],
  "lastModified": "2026-06-17T06:58:21.150",
  "sourceIdentifier": "security@grafana.com"
}