CVE-2025-8341
SSRF in Infinity Datasource Plugin
- State
- Published
- Severity
- 5.0 Medium
- Published
- Aug 4, 2025
- Updated
- Aug 4, 2025
- Reserved
- Jul 30, 2025
Description
Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints.
If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.0 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N | GRAFANA |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
grafana-infinity-datasourceGrafana |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.