GitHub Advisoryadvisory · Go

GHSA-wxcc-2f3q-4h58 Grafana Alerting VictorOps integration could be exposed to users with Viewer permission

MEDIUM Published 2025-01-31 Modified 2025-07-08 Official page ↗
Aliases
CVE-2024-11741
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2025-01-31

Affected packages

• Go github.com/grafana/grafana: >= 11.4.0, < 11.4.1 → fixed in 11.4.1 • Go github.com/grafana/grafana: >= 11.3.0, < 11.3.3 → fixed in 11.3.3 • Go github.com/grafana/grafana: >= 11.2.0, < 11.2.6 → fixed in 11.2.6 • Go github.com/grafana/grafana: >= 11.1.0, < 11.1.11 → fixed in 11.1.11 • Go github.com/grafana/grafana: >= 11.0.0, < 11.0.11 → fixed in 11.0.11 • Go github.com/grafana/grafana: >= 1.9.2, < 10.4.15 → fixed in 10.4.15 • Go github.com/grafana/grafana: < 0.0.0-20250129224826-70073427041e → fixed in 0.0.0-20250129224826-70073427041e • Go github.com/grafana/grafana: >= 0.0.0, < 1.9.2-0.20250129224826-70073427041e → fixed in 1.9.2-0.20250129224826-70073427041e

Description

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15

Related

Alias · CVE (1)

  • CVE-2024-11741 Grafana is an open-source platform for monitoring and observability. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References