{"id":"CVE-2024-11741","published":"2025-01-31T15:12:29Z","modified":"2025-05-09T20:03:33Z","title":"Grafana is an open-source platform for monitoring and observability","vendor":"Grafana","product":"Grafana","tier":"tail","description":{"text":"Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3,  11.2.6, 11.1.11, 11.0.11 and 10.4.15","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00411,"percentile":0.35308,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2024-11741/","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20250509-0006/","tags":[]}],"priority":{"score":10.1,"factors":[{"name":"EPSS percentile","points":7.06},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"grafana","affectedVersions":[{"vendor":"Grafana","product":"Grafana","versions":[">= 11.4.0, < 11.4.1",">= 11.3.0, < 11.3.3",">= 11.2.0, < 11.2.6",">= 11.1.0, < 11.1.11",">= 10.4.0, < 10.4.15"]}],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=11.4.0, <11.4.1",">=11.3.0, <11.3.3",">=11.2.0, <11.2.6",">=11.1.0, <11.1.11",">=11.0.0, <11.0.11",">=1.9.2, <10.4.15","<0.0.0-20250129224826-70073427041e",">=0.0.0, <1.9.2-0.20250129224826-70073427041e","all versions"],"patched":["11.4.1","11.3.3","11.2.6","11.1.11","11.0.11","10.4.15","0.0.0-20250129224826-70073427041e","1.9.2-0.20250129224826-70073427041e"],"from":["GHSA-wxcc-2f3q-4h58","GO-2025-3438"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-0215","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-grafana-cve-2024-11741","children":[{"from":"CVE-2024-11741","to":"CVE-2025-3415","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"1.9.2-0.20250129224826-70073427041e","toFixed":"1.9.2-0.20250514160932-04111e9f2afd","daysApart":167},{"kind":"same-code","provenance":"machine","files":["pkg/services/ngalert/notifier/channels_config/available_channels.go"],"commits":["https://github.com/grafana/grafana/commit/70073427041e15c353e0d467b714527584765aea","https://github.com/grafana/grafana/commit/04111e9f2afd95ea3e5b01865cc29d3fc1198e71","https://github.com/grafana/grafana/commit/0adb869188fa2b9ae26efd424b94e17189538f29"],"basis":"shared function","functions":["GetAvailableNotifiers"]},{"kind":"similar","provenance":"machine","score":0.58,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2025-3454","published":"2025-06-02","fixed":"0.0.0-20250424191517-1f707d16ed5d","kev":false,"link":{"from":"CVE-2024-11741","to":"CVE-2025-3454","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"0.0.0-20250129224826-70073427041e","toFixed":"0.0.0-20250424191517-1f707d16ed5d","daysApart":122}]}},{"cve":"CVE-2024-1313","published":"2024-03-26","fixed":"10.3.5","kev":false,"link":{"from":"CVE-2024-1313","to":"CVE-2024-11741","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"10.3.5","toFixed":"10.4.15","daysApart":311}]}},{"cve":"CVE-2024-6322","published":"2024-08-20","fixed":"11.1.3","kev":false,"link":{"from":"CVE-2024-6322","to":"CVE-2024-11741","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"1.9.2-0.20240725142242-c326d865c58b","toFixed":"1.9.2-0.20250129224826-70073427041e","daysApart":164},{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"0.0.0-20240725142242-c326d865c58b","toFixed":"0.0.0-20250129224826-70073427041e","daysApart":164}]}},{"cve":"CVE-2024-9264","published":"2024-10-18","fixed":"11.2.2+security-01","kev":false,"link":{"from":"CVE-2024-9264","to":"CVE-2024-11741","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"11.2.2+security-01","toFixed":"11.2.6","daysApart":105}]}},{"cve":"CVE-2024-11741","published":"2025-01-31","fixed":"11.4.1","kev":false},{"cve":"CVE-2025-1088","published":"2025-06-18","fixed":"11.6.2","kev":false,"link":{"from":"CVE-2024-11741","to":"CVE-2025-1088","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"11.4.1","toFixed":"11.6.2","daysApart":138}]}},{"cve":"CVE-2025-41115","published":"2025-11-21","fixed":"12.2.2","kev":false},{"cve":"CVE-2025-41117","published":"2026-02-12","fixed":"12.3.3","kev":false}],"package":"Go:github.com/grafana/grafana"}}