Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4482-1 advisory.

    grafana was updated from version 11.5.5 to 11.5.10:

    - Security issues fixed:

      * CVE-2025-64751: Dropped experimental implementation of authorization Zanzana server/client (version     11.5.10)         (bsc#1254113)
      * CVE-2025-47911: Fixed parsing HTML documents (version 11.5.10) (bsc#1251454)
      * CVE-2025-58190: Fixed excessive memory consumption (version 11.5.10) (bsc#1251657)
      * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
      * CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)
      * CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)
      * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version     11.5.6)                        (bsc#1245302)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4458-1 advisory.

    dracut-saltboot:

    - Update to version 1.0.0
      * Reboot on salt key timeout (bsc#1237495)
      * Fixed parsing files with space in the name (bsc#1252100)

    grafana was updated from version 11.5.5 to 11.5.10:

    - Security issues fixed:

      * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
      * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)
      * CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client                         (bsc#1254113)
      * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
      * CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)
      * CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)
      * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version     11.5.6)                        (bsc#1245302)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0596 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-1088:
    An access control vulnerability was discovered in Grafana OSS where an Organization administrator could     permanently delete the Server administrator account. This vulnerability exists in the DELETE     /api/org/users/ endpoint.

    The vulnerability can be exploited when:

    1. An Organization administrator exists

    2. The Server administrator is either:

     - Not part of any organization, or
     - Part of the same organization as the Organization administrator     Impact:

    - Organization administrators can permanently delete Server administrator accounts

    - If the only Server administrator is deleted, the Grafana instance becomes unmanageable

    - No super-user permissions remain in the system

    - Affects all users, organizations, and teams managed in the instance

    The vulnerability is particularly serious as it can lead to a complete loss of administrative control over     the Grafana instance.

    CVE-2024-10452:
    Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing     integration was not properly protected and could be exposed to users with Viewer permission.
    Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01,     11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

    CVE-2025-3580:
    In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become     unresponsive due to Improper Input Validation vulnerability in Grafana.
    This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

    CVE-2025-3415:
    Organization admins can delete pending invites created in an organization they are not part of.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing     integration was not properly protected and could be exposed to users with Viewer permission. Fixed in     versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01,     11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01 (CVE-2025-3415)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Grafana Labs installed on the remote host is affected by a vulnerability as referenced in the CVE-2025-3415 advisory. 

  - Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing     integration was not properly protected and could be exposed to users with Viewer permission.     (CVE-2025-3415)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6548cb01-4c33-11f0-8a97-6c3be5272acd advisory.

    Grafana Labs reports:
    An incident occurred where the DingDing alerting integration URL               was inadvertently exposed to viewers due to a setting oversight,               which we learned about through a bug bounty report.
    The CVSS 3.0 score for this vulnerability is 4.3 (Medium).

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
279356	SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:4482-1)	Nessus	SuSE Local Security Checks	medium
279353	openSUSE 15 : Security update 5.0.6 for Multi-Linux Manager Client Tools (SUSE-SU-2025:4458-1)	Nessus	SuSE Local Security Checks	high
249979	TencentOS Server 4: grafana (TSSA-2025:0596)	Nessus	Tencent Local Security Checks	low
244247	Linux Distros Unpatched Vulnerability : CVE-2025-3415	Nessus	Misc.	medium
242626	Grafana Labs Integration URL Exposed to Viewers (CVE-2025-3415)	Nessus	Web Servers	medium
240187	FreeBSD : Grafana -- DingDing contact points exposed in Grafana Alerting (6548cb01-4c33-11f0-8a97-6c3be5272acd)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2025-3415

medium

Tenable Plugins

medium

high

low

medium

medium

high