{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-3415/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-3415/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-3415/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-3415/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-3415/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-3415"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-3415"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.00983,
      "kev": false,
      "percentile": 0.60675
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-3415.yaml",
      "nuclei_template_severity": "medium",
      "nuclei_template_yaml": "id: CVE-2025-3415\n\ninfo:\n  name: Grafana - Exposes DingDing API Keys\n  author: lucasribolli\n  severity: medium\n  description: |\n    An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1.\n  impact: |\n    Viewers can access DingDing alerting integration URLs containing access tokens through the alertmanager API, potentially enabling unauthorized message delivery and notification manipulation.\n  remediation: |\n    Upgrade to Grafana version 12.0.2 or later that properly restricts access to DingDing integration settings.\n  reference:\n    - https://grafana.com/blog/2025/06/13/grafana-security-update-medium-severity-security-release-for-cve-2025-3415/\n  classification:\n    epss-score: 0.00983\n    epss-percentile: 0.60675\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: grafana\n    product: grafana\n    shodan-query:\n      - http.title:\"grafana\"\n      - cpe:\"cpe:2.3:a:grafana:grafana\"\n    fofa-query:\n      - title=\"grafana\"\n      - app=\"grafana\"\n    google-query: intitle:\"grafana\"\n  tags: cve,cve2025,grafana,dingding,dingtalk,apikey,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /api/alertmanager/grafana/config/api/v1/alerts HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"dingtalk.com\",\"dingding-context\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: dingding-integration-url\n        part: body\n        regex:\n          - '(?i)https?://oapi\\.dingtalk\\.com/robot/send\\?access_token=[^&\"\\s]+'\n# digest: 4b0a00483046022100de5ba9a2bba79c7b677110b52f39da574a49a86ff3b368936104baf8770fe166022100ad92d720e79e8e2f52b66edb357a323963939dfa7e31b231258fb6f36513f90a:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-3415"
}