PT-2025-1685 · Grafana+2 · Grafana+2

Published 2025-01-31 · Updated 2025-06-18 · CVE-2024-11741

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 10.4.15 Grafana versions prior to 11.0.11 Grafana versions prior to 11.1.11 Grafana versions prior to 11.2.6 Grafana versions prior to 11.3.3 Grafana versions prior to 11.4.1 Grafana versions prior to 11.5.0

Description The issue is related to the Grafana Alerting VictorOps integration, which was not properly protected and could be exposed to users with Viewer permission. This could allow a remote attacker to access potentially confidential information.

Recommendations For versions prior to 10.4.15, update to version 10.4.15 or later. For versions prior to 11.0.11, update to version 11.0.11 or later. For versions prior to 11.1.11, update to version 11.1.11 or later. For versions prior to 11.2.6, update to version 11.2.6 or later. For versions prior to 11.3.3, update to version 11.3.3 or later. For versions prior to 11.4.1, update to version 11.4.1 or later. For versions prior to 11.5.0, update to version 11.5.0 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-02447

BIT-GRAFANA-2024-11741

CVE-2024-11741

GHSA-WXCC-2F3Q-4H58

GO-2025-3438

OPENSUSE-SU-2025:14724-1

OPENSUSE-SU-2025:14732-1

OPENSUSE-SU-2025_0429-1

OPENSUSE-SU-2025_0623-1

SUSE-SU-2025:01985-1

SUSE-SU-2025:0429-1

SUSE-SU-2025:0622-1

SUSE-SU-2025:0623-1

SUSE-SU-2025:0624-1

Affected Products

Grafana

Red Os

Suse

References · 80

• https://osv.dev/vulnerability/SUSE-SU-2025:0623-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3438 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02447 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:0622-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14732-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-11741 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0429-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/BIT-grafana-2024-11741 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-11741 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:01985-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11741 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14724-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11741 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0624-1 · Vendor Advisory