CVE-2025-3454: Medium severity grafana labs grafana oss and enterprise vulnerability
This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.
Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.
The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3454?
CVE-2025-3454 is considered a high-severity vulnerability due to the potential for unauthorized access.
How do I fix CVE-2025-3454?
To fix CVE-2025-3454, update Grafana to the latest version where this vulnerability has been patched.
What systems are affected by CVE-2025-3454?
CVE-2025-3454 affects Grafana, Alertmanager, and Prometheus instances.
Can CVE-2025-3454 be exploited remotely?
Yes, CVE-2025-3454 can be exploited remotely due to the nature of the authorization bypass.
What does CVE-2025-3454 allow an attacker to do?
CVE-2025-3454 allows attackers to bypass authorization checks and gain unauthorized read access to certain resources.