CVE-2025-8341

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-8341
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8341.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-8341
Aliases
Downstream
Related
Published
2025-08-04T08:34:50.669Z
Modified
2026-07-15T01:49:15.676114597Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
SSRF in Infinity Datasource Plugin
Details

Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints.

If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8341.json",
    "cna_assigner": "GRAFANA",
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/grafana/grafana-infinity-datasource

Affected ranges

Type
GIT
Repo
https://github.com/grafana/grafana-infinity-datasource
Events
Introduced
de516a6e3c3aa1a1035ade6069f31a0a47ba7312
Fixed
9c736aa21b3a669d3070d3f5f80d949326fafa77
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.6.0"
        },
        {
            "fixed": "3.4.1"
        }
    ]
}

Affected versions

0.*
0.0.0-x
v0.*
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.7.3
v0.7.4
v0.7.6
v0.7.66209fb222281817bb562228395e3af06b40cebec
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.0-beta.1
v0.8.0-beta.2
v0.8.0-dev.10
v0.8.0-dev.4
v0.8.0-dev.6
v0.8.0-dev.7
v0.8.0-dev.8
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v1.*
v1.0.0
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-dev.1
v1.0.0-dev.2
v1.0.0-dev.3
v1.0.0-dev.4
v1.0.0-dev.5
v1.0.1
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.4.1
v2.*
v2.0.0
v2.1.0
v2.11.2
v2.12.1
v2.12.2
v2.2.0
v2.2.1
v2.3.0
v2.5.0
v2.7.0
v2.7.1
v3.*
v3.0.0
v3.0.0-beta.1
v3.0.0-beta.2
v3.1.0
v3.2.0
v3.2.1
v3.2.2
v3.3.0
v3.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8341.json"