CVE-2025-41115
CRITICAL10.0EPSS 0.06%Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana
發布日:2025/11/21修改日:2026/2/4
描述
Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20251106142618-ca5d89812015, from v12.0.0 before v12.0.7, from v12.1.0 before v12.1.4, from v12.2.0 before v12.2.2.
受影響套件(3)
- Bitnami/grafana>= 12.0.0, < 12.2.1
- Go/github.com/grafana/grafana>= 12.0.0, < 12.0.7
- Go/github.com/grafana/grafana>= 1.9.2-0.20250310110405-e6fdb746f235
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
參考連結(9)
- ADVISORYhttps://github.com/advisories/GHSA-w62r-7c53-fmc5
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-41115
- PATCHhttps://github.com/grafana/grafana
- WEBhttps://github.com/grafana/grafana/commit/ca5d89812015ef2db3acc62826f73650450b331e
- WEBhttps://github.com/grafana/grafana/releases/tag/v12.0.7
- WEBhttps://github.com/grafana/grafana/releases/tag/v12.1.4
- WEBhttps://github.com/grafana/grafana/releases/tag/v12.2.2
- WEBhttps://github.com/grafana/grafana/releases/tag/v12.3.0
- WEBhttps://grafana.com/security/security-advisories/CVE-2025-41115