cve-2025-3415
MEDIUM CVSS 4.3 csaf_redhat
Description
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Timeline
- Published
- 2025-06-24 00:00 UTC
- Last Modified
- 2026-07-11
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
No references available.
Linked Vulnerabilities
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright © Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-3415.json"
}
],
"title": "grafana: Exposure of DingDing alerting integration URL to Viewer level users",
"tracking": {
"current_release_date": "2026-07-11T17:42:33+00:00",
"generator": {
"date": "2026-07-11T17:42:33+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.2"
}
},
"id": "CVE-2025-3415",
"initial_release_date": "2025-06-24T00:00:00+00:00",
"revision_history": [
{
"date": "2025-06-24T00:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-08-13T12:53:08+00:00",
"number": "2",
"summary": "Current version"
},
{
"date": "2026-07-11T17:42:33+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux 10",
"product": {
"name": "Red Hat Enterprise Linux 10",
"product_id": "red_hat_enterprise_linux_10",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux 10"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux 8",
"product": {
"name": "Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux 8"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux 9",
"product": {
"name": "Red Hat Enterprise Linux 9",
"product_id": "red_hat_enterprise_linux_9",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux 9"
},
{
"category": "product_version",
"name": "grafana",
"product": {
"name": "grafana",
"product_id": "grafana",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana"
}
}
},
{
"category": "product_version",
"name": "grafana.src",
"product": {
"name": "grafana.src",
"product_id": "grafana.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana?arch=src"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux",
"product": {
"name": "grafana-selinux",
"product_id": "grafana-selinux",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux"
}
}
},
{
"category": "product_version",
"name": "grafana-graphite",
"product": {
"name": "grafana-graphite",
"product_id": "grafana-graphite",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-graphite"
}
}
},
{
"category": "product_version",
"name": "grafana-elasticsearch",
"product": {
"name": "grafana-elasticsearch",
"product_id": "grafana-elasticsearch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-elasticsearch"
}
}
},
{
"category": "product_version",
"name": "grafana-mysql",
"product": {
"name": "grafana-mysql",
"product_id": "grafana-mysql",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-mysql"
}
}
},
{
"category": "product_version",
"name": "grafana-stackdriver",
"product": {
"name": "grafana-stackdriver",
"product_id": "grafana-stackdriver",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-stackdriver"
}
}
},
{
"category": "product_version",
"name": "grafana-postgres",
"product": {
"name": "grafana-postgres",
"product_id": "grafana-postgres",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-postgres"
}
}
},
{
"category": "product_version",
"name": "grafana-azure-monitor",
"product": {
"name": "grafana-azure-monitor",
"product_id": "grafana-azure-monitor",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-azure-monitor"
}
}
},
{
"category": "product_version",
"name": "grafana-mssql",
"product": {
"name": "grafana-mssql",
"product_id": "grafana-mssql",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-mssql"
}
}
},
{
"category": "product_version",
"name": "grafana-opentsdb",
"product": {
"name": "grafana-opentsdb",
"product_id": "grafana-opentsdb",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-opentsdb"
}
}
},
{
"category": "product_version",
"name": "grafana-prometheus",
"product": {
"name": "grafana-prometheus",
"product_id": "grafana-prometheus",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-prometheus"
}
}
},
{
"category": "product_version",
"name": "grafana-loki",
"product": {
"name": "grafana-loki",
"product_id": "grafana-loki",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-loki"
}
}
},
{
"category": "product_version",
"name": "grafana-cloudwatch",
"product": {
"name": "grafana-cloudwatch",
"product_id": "grafana-cloudwatch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-cloudwatch"
}
}
},
{
"category": "product_version",
"name": "grafana-influxdb",
"product": {
"name": "grafana-influxdb",
"product_id": "grafana-influxdb",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-influxdb"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana as a component of Red Hat Enterprise Linux 10",
"product_id": "red_hat_enterprise_linux_10:grafana"
},
"product_reference": "grafana",
"relates_to_product_reference": "red_hat_enterprise_linux_10"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux as a component of Red Hat Enterprise Linux 10",
"product_id": "red_hat_enterprise_linux_10:grafana-selinux"
},
"product_reference": "grafana-selinux",
"relates_to_product_reference": "red_hat_enterprise_linux_10"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana.src as a component of Red Hat Enterprise Linux 10",
"product_id": "red_hat_enterprise_linux_10:grafana.src"
},
"product_reference": "grafana.src",
"relates_to_product_reference": "red_hat_enterprise_linux_10"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana"
},
"product_reference": "grafana",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-azure-monitor as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-azure-monitor"
},
"product_reference": "grafana-azure-monitor",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-cloudwatch as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-cloudwatch"
},
"product_reference": "grafana-cloudwatch",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-elasticsearch as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-elasticsearch"
},
"product_reference": "grafana-elasticsearch",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-graphite as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-graphite"
},
"product_reference": "grafana-graphite",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-influxdb as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-influxdb"
},
"product_reference": "grafana-influxdb",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-loki as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-loki"
},
"product_reference": "grafana-loki",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-mssql as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-mssql"
},
"product_reference": "grafana-mssql",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-mysql as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-mysql"
},
"product_reference": "grafana-mysql",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-opentsdb as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-opentsdb"
},
"product_reference": "grafana-opentsdb",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-postgres as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-postgres"
},
"product_reference": "grafana-postgres",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-prometheus as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-prometheus"
},
"product_reference": "grafana-prometheus",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-selinux"
},
"product_reference": "grafana-selinux",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-stackdriver as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana-stackdriver"
},
"product_reference": "grafana-stackdriver",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana.src as a component of Red Hat Enterprise Linux 8",
"product_id": "red_hat_enterprise_linux_8:grafana.src"
},
"product_reference": "grafana.src",
"relates_to_product_reference": "red_hat_enterprise_linux_8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana as a component of Red Hat Enterprise Linux 9",
"product_id": "red_hat_enterprise_linux_9:grafana"
},
"product_reference": "grafana",
"relates_to_product_reference": "red_hat_enterprise_linux_9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux as a component of Red Hat Enterprise Linux 9",
"product_id": "red_hat_enterprise_linux_9:grafana-selinux"
},
"product_reference": "grafana-selinux",
"relates_to_product_reference": "red_hat_enterprise_linux_9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana.src as a component of Red Hat Enterprise Linux 9",
"product_id": "red_hat_enterprise_linux_9:grafana.src"
},
"product_reference": "grafana.src",
"relates_to_product_reference": "red_hat_enterprise_linux_9"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-3415",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-06-24T11:33:02.624000+00:00",
"flags": [
{
"label": "component_not_present",
"product_ids": [
"red_hat_enterprise_linux_10:grafana",
"red_hat_enterprise_linux_10:grafana-selinux",
"red_hat_enterprise_linux_10:grafana.src",
"red_hat_enterprise_linux_8:grafana",
"red_hat_enterprise_linux_8:grafana-azure-monitor",
"red_hat_enterprise_linux_8:grafana-cloudwatch",
"red_hat_enterprise_linux_8:grafana-elasticsearch",
"red_hat_enterprise_linux_8:grafana-graphite",
"red_hat_enterprise_linux_8:grafana-influxdb",
"red_hat_enterprise_linux_8:grafana-loki",
"red_hat_enterprise_linux_8:grafana-mssql",
"red_hat_enterprise_linux_8:grafana-mysql",
"red_hat_enterprise_linux_8:grafana-opentsdb",
"red_hat_enterprise_linux_8:grafana-postgres",
"red_hat_enterprise_linux_8:grafana-prometheus",
"red_hat_enterprise_linux_8:grafana-selinux",
"red_hat_enterprise_linux_8:grafana-stackdriver",
"red_hat_enterprise_linux_8:grafana.src",
"red_hat_enterprise_linux_9:grafana",
"red_hat_enterprise_linux_9:grafana-selinux",
"red_hat_enterprise_linux_9:grafana.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2374538"
}
],
"notes": [
{
"category": "description",
"text": "A flaw exists in Grafana Alerting, where the DingDing contact-point integration URL can be revealed in plain text to users with viewer-level permissions due to misconfigured access control. This disclosure permits unauthorized users to view sensitive webhook URLs, including API tokens or keys, without needing elevated privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: Exposure of DingDing alerting integration URL to Viewer level users",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Grafana development team assessed this as a Medium severity information exposure issue. Viewer-role users can now access sensitive webhook URLs, enabling them to hijack or misuse notifications through the DingDing integration. The underlying cause is weak access control policies that do not restrict configuration data from lower-privileged roles.\n\nA third-party application, the DingTalk plugin, and explicit configuration not shipped or supported by Red Hat are required to exploit this issue. Therefore, Red Hat products are not vulnerable to this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"known_not_affected": [
"red_hat_enterprise_linux_10:grafana",
"red_hat_enterprise_linux_10:grafana-selinux",
"red_hat_enterprise_linux_10:grafana.src",
"red_hat_enterprise_linux_8:grafana",
"red_hat_enterprise_linux_8:grafana-azure-monitor",
"red_hat_enterprise_linux_8:grafana-cloudwatch",
"red_hat_enterprise_linux_8:grafana-elasticsearch",
"red_hat_enterprise_linux_8:grafana-graphite",
"red_hat_enterprise_linux_8:grafana-influxdb",
"red_hat_enterprise_linux_8:grafana-loki",
"red_hat_enterprise_linux_8:grafana-mssql",
"red_hat_enterprise_linux_8:grafana-mysql",
"red_hat_enterprise_linux_8:grafana-opentsdb",
"red_hat_enterprise_linux_8:grafana-postgres",
"red_hat_enterprise_linux_8:grafana-prometheus",
"red_hat_enterprise_linux_8:grafana-selinux",
"red_hat_enterprise_linux_8:grafana-stackdriver",
"red_hat_enterprise_linux_8:grafana.src",
"red_hat_enterprise_linux_9:grafana",
"red_hat_enterprise_linux_9:grafana-selinux",
"red_hat_enterprise_linux_9:grafana.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-3415"
},
{
"category": "external",
"summary": "RHBZ#2374538",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374538"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-3415",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3415"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-3415",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3415"
},
{
"category": "external",
"summary": "https://grafana.com/blog/2025/06/13/grafana-security-update-medium-severity-security-release-for-cve-2025-3415/",
"url": "https://grafana.com/blog/2025/06/13/grafana-security-update-medium-severity-security-release-for-cve-2025-3415/"
}
],
"release_date": "2025-06-24T00:00:00+00:00",
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"red_hat_enterprise_linux_10:grafana",
"red_hat_enterprise_linux_10:grafana-selinux",
"red_hat_enterprise_linux_10:grafana.src",
"red_hat_enterprise_linux_8:grafana",
"red_hat_enterprise_linux_8:grafana-azure-monitor",
"red_hat_enterprise_linux_8:grafana-cloudwatch",
"red_hat_enterprise_linux_8:grafana-elasticsearch",
"red_hat_enterprise_linux_8:grafana-graphite",
"red_hat_enterprise_linux_8:grafana-influxdb",
"red_hat_enterprise_linux_8:grafana-loki",
"red_hat_enterprise_linux_8:grafana-mssql",
"red_hat_enterprise_linux_8:grafana-mysql",
"red_hat_enterprise_linux_8:grafana-opentsdb",
"red_hat_enterprise_linux_8:grafana-postgres",
"red_hat_enterprise_linux_8:grafana-prometheus",
"red_hat_enterprise_linux_8:grafana-selinux",
"red_hat_enterprise_linux_8:grafana-stackdriver",
"red_hat_enterprise_linux_8:grafana.src",
"red_hat_enterprise_linux_9:grafana",
"red_hat_enterprise_linux_9:grafana-selinux",
"red_hat_enterprise_linux_9:grafana.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate",
"product_ids": [
"red_hat_enterprise_linux_10:grafana",
"red_hat_enterprise_linux_10:grafana-selinux",
"red_hat_enterprise_linux_10:grafana.src",
"red_hat_enterprise_linux_8:grafana",
"red_hat_enterprise_linux_8:grafana-azure-monitor",
"red_hat_enterprise_linux_8:grafana-cloudwatch",
"red_hat_enterprise_linux_8:grafana-elasticsearch",
"red_hat_enterprise_linux_8:grafana-graphite",
"red_hat_enterprise_linux_8:grafana-influxdb",
"red_hat_enterprise_linux_8:grafana-loki",
"red_hat_enterprise_linux_8:grafana-mssql",
"red_hat_enterprise_linux_8:grafana-mysql",
"red_hat_enterprise_linux_8:grafana-opentsdb",
"red_hat_enterprise_linux_8:grafana-postgres",
"red_hat_enterprise_linux_8:grafana-prometheus",
"red_hat_enterprise_linux_8:grafana-selinux",
"red_hat_enterprise_linux_8:grafana-stackdriver",
"red_hat_enterprise_linux_8:grafana.src",
"red_hat_enterprise_linux_9:grafana",
"red_hat_enterprise_linux_9:grafana-selinux",
"red_hat_enterprise_linux_9:grafana.src"
]
}
],
"title": "grafana: Exposure of DingDing alerting integration URL to Viewer level users"
}
]
}
Enrichment data
Aggregated bundle (all enrichments)