CVE-2025-12141

Katalog CVE

CVSS 6.5 · Medium EPSS 0,26%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada grafana. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.

Rincian

Terbit di NVD

15 April 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 15,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://grafana.com/security/security-advisories/cve-2025-12141/ advisory vendor