CVE-2025-8341

MEDIUM EPSS 20.0%

Published Aug 4, 202511mo ago · Modified Jun 17, 20261w ago

5.0 CVSS 3.1

Medium

Published Aug 4, 2025 11mo ago

Last Modified Jun 17, 2026 1w ago

Description

Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.

CVSS Details

Base Score

5.0

Exploitability

3.1

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Changed

Confidentiality Low

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

20.0% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

References 2

github.com https://github.com/grafana/grafana-infinity-datasource/releases/tag/v3.4.1
grafana.com https://grafana.com/security/security-advisories/cve-2025-8341/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.