CVE-2025-6023 describes an open redirect vulnerability in Grafana OSS, introduced in version 11.5.0, which can be chained with path traversal to enable Cross-Site Scripting (XSS) attacks. This vulnerability carries a high CVSS score of 7.6, indicating a significant risk due to its network-based attack vector and low attack complexity, potentially leading to high confidentiality impact and low integrity/availability impact. While no public exploits or active exploitation have been observed, and community discussion is minimal, organizations using affected Grafana versions should upgrade to patched versions (12.0.2+, 11.6.3+, 11.5.6+, 11.4.6+, or 11.3.8+) to mitigate the risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Grafana | Grafana | >= 11.3.x, < 11.3.8+security-01, >= 11.4.x, < 11.4.6+security-01, >= 11.5.x, < 11.5.6+security-01, >= 11.6.x, < 11.6.3+security-01, >= 12.0.x, < 12.0.2+security-01CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
grafana: Cross Site Scripting in Grafana
Jul 22, 2025Grafana is vulnerable to XSS attacks through open redirects and path traversal
Jul 18, 2025XSS in Scripted Dashboards in Grafana
Jul 18, 2025XSS in Scripted Dashboards in Grafana
Jul 18, 2025XSS in Scripted Dashboards in Grafana
Jul 18, 2025XSS in Scripted Dashboards in Grafana
Jul 18, 2025XSS in Scripted Dashboards in Grafana
Jul 18, 2025XSS in Scripted Dashboards in Grafana
Jul 18, 2025