CVE-2024-11741: 
Grafana vulnerability analysis and mitigation

Grafana, an open-source platform for monitoring and observability, disclosed a security vulnerability (CVE-2024-11741) on January 31, 2025. The vulnerability affects the Grafana Alerting VictorOps integration, which was not properly protected and could be exposed to users with Viewer permission (Grafana Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires network access and low privileges to exploit, with no user interaction needed. The impact is primarily limited to confidentiality, with no impact on integrity or availability (NVD).

The vulnerability could allow users with Viewer permissions to access sensitive information through the VictorOps integration that they should not have access to (Grafana Advisory).

The vulnerability has been fixed in multiple Grafana versions including 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11, and 10.4.15. Users are advised to upgrade to these patched versions to mitigate the vulnerability (Grafana Advisory).