Riskcovery

CVE-2025-4123

State
Published
Severity
7.6 High
Published
May 22, 2025
Updated
Apr 29, 2026
Reserved
Apr 30, 2025

Read the record on cve.org

Description

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.

The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

Scores

CVSSScoreVectorSource
3.17.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:LGRAFANA

Weaknesses

Affected Products

ProductVersions
GrafanaGrafana
  • 10.4.18+security-01 to before 10.4.19Affected
  • 11.2.9+security-01 to before 11.2.10Affected
  • 11.3.6+security-01 to before 11.3.7Affected
  • 11.4.4+security-01 to before 11.4.5Affected
  • 11.5.4+security-01 to before 11.5.5Affected
  • 11.6.1+security-01 to before 11.6.2Affected
  • 12.0.0+security-01 to before 12.0.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.