SecuriTricks - CVE-2025-3454

Description

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

Product(s) Impacted

Vendor	Product	Versions
Grafana	Grafana Alertmanager	* *
Prometheus	Prometheus	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-285

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	grafana	grafana	/	/	/	/	/	/	/	/
a	grafana	alertmanager	/	/	/	/	/	/	/	/
a	prometheus	prometheus	/	/	/	/	/	/	/	/

References

https://grafana.com/security/security-advisories/cve-2025-3454/

CVSS Score

5.0 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: CHANGED
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

View Vector String

Timeline

Published: June 2, 2025, 11:15 a.m.
Last Modified: June 2, 2025, 5:32 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@grafana.com

CVE-2025-3454