VulnerabilityDeferred

CVE-2024-11741

The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission.

MEDIUM 4.3EPSS 0.38%

Does this matter?

Lower severity and a low EPSS score (0.38%). Track it; it rarely justifies an emergency change on its own.

Description

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.38% probability · 32th percentile
CISA KEV: Not listed
Weakness: CWE-200
Source: security@grafana.com

References

https://grafana.com/security/security-advisories/cve-2024-11741/
https://security.netapp.com/advisory/ntap-20250509-0006/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.