Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

ubuntu логотип

CVE-2025-3454

Опубликовано: 02 июн. 2025
Источник: ubuntu
Приоритет: medium
CVSS3: 5

Описание

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

РелизСтатусПримечание
devel

DNE

esm-apps-legacy/xenial

needs-triage

esm-apps/xenial

ignored

end of ESM support, was needs-triage
esm-infra/focal

DNE

focal

DNE

jammy

DNE

noble

DNE

oracular

DNE

plucky

DNE

questing

DNE

Показывать по

Ссылки на источники

5 Medium

CVSS3

Связанные уязвимости

CVSS3: 4.3
redhat
больше 1 года назад

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

CVSS3: 5
nvd
около 1 года назад

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

CVSS3: 5
debian
около 1 года назад

This vulnerability in Grafana's datasource proxy API allows authorizat ...

CVSS3: 5
github
около 1 года назад

Grafana's datasource proxy API allows authorization checks to be bypassed

CVSS3: 5
fstec
около 1 года назад

Уязвимость API прокси-сервера источника данных платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю получить несанкционированный доступ для чтения к конечным точкам GET в источниках данных Alertmanager и Prometheus

5 Medium

CVSS3