CVE-2025-8341
Last modified
CVE-2025-8341 is a medium-severity vulnerability rated 5/10 on the CVSS scale. Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-8341?
How severe is CVE-2025-8341?
How do I fix CVE-2025-8341?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-8335A vulnerability classified as problematic has been found in …4.3
- CVE-2025-8336A vulnerability classified as critical was found in Campcode…9.8
- CVE-2025-8337A vulnerability, which was classified as problematic, has be…5.4
- CVE-2025-8338A vulnerability was found in projectworlds Online Admission …9.8
- CVE-2025-8339A vulnerability was found in code-projects Intern Membership…9.8
- CVE-2025-8340A vulnerability was found in code-projects Intern Membership…6.1
- CVE-2025-8342The WooCommerce OTP Login With Phone Number, OTP Verificatio…8.1
- CVE-2025-8343A vulnerability was found in openviglet shio up to 0.3.8. It…9.8
- CVE-2025-8344A vulnerability classified as critical has been found in ope…9.8
- CVE-2025-8345A vulnerability classified as critical was found in Shanghai…9.8
- CVE-2025-8346A vulnerability, which was classified as problematic, has be…6.1
- CVE-2025-8347A vulnerability, which was classified as critical, was found…6.5
Are you affected by CVE-2025-8341?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST