BSD PortsGrafana -- DingDing contact points exposed in Grafana Alerting
Grafana Labs reports: An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight, which we learned about through a bug bounty report . The CVSS 3.0 score for this vulnerability is 4.3 (Medium).
Affected versions
- grafana < 10.4.19+security-01; >= 11.0.0 < 11.2.10+security-01; >= 11.3.0 < 11.3.7+security-01; >= 11.4.0 < 11.4.5+security-01; >= 11.5.0 < 11.5.5+security-01; >= 11.6.0 < 11.6.2+security-01; >= 12.0.0 < 12.0.1+security-01
- grafana8 >= 8.0.0
- grafana9 >= 9.0.0
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | www/grafana | 10.4.1_4 | vulnerable since 2025-06-18 | |
| OpenBSD | sysutils/grafana | 13.1.5 | out of range, by version | |
| NetBSD | www/grafana | 13.2.0nb3 | not listed | |
| MidnightBSD | www/grafana | 13.2.4 | out of range, by version | |
| FreeBSD | www/grafana | 13.1.1_5 | fixed | (403 days after) |