CVE-2025-6023
CVE-2025-6023
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01
CVSS 7.6 · High · EPSS 57.7% · Fix available
- Published
- Updated
Stack: system · applications
Affected products and versions
grafana
- Versions
- ≥ 12.0.x, < 12.0.2+security-01: Affected (semver)
- ≥ 11.6.x, < 11.6.3+security-01: Affected (semver)
- ≥ 11.5.x, < 11.5.6+security-01: Affected (semver)
- ≥ 11.4.x, < 11.4.6+security-01: Affected (semver)
- ≥ 11.3.x, < 11.3.8+security-01: Affected (semver)
Update to 11.3.8+security-01; Update to 11.4.6+security-01; Update to 11.5.6+security-01; Update to 11.6.3+security-01; Update to 12.0.2+security-01
grafana Ubuntu:16.04:LTS
- Versions
- 2.6.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published