CVE-2025-6023

State: Published
Severity: 7.6 High
Published: Jul 18, 2025
Updated: Jul 18, 2025
Reserved: Jun 12, 2025

Description

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.

The open redirect can be chained with path traversal vulnerabilities to achieve XSS.

Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01

Scores

CVSS	Score	Vector	Source
3.1	7.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L	GRAFANA

Weaknesses

Affected Products

Product	Versions
GrafanaGrafana	12.0.x to before 12.0.2+security-01Affected 11.6.x to before 11.6.3+security-01Affected 11.5.x to before 11.5.6+security-01Affected 11.4.x to before 11.4.6+security-01Affected 11.3.x to before 11.3.8+security-01Affected

References

Security vulnerability management issuevendor-advisory
https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/release-notesmitigation

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.