PT-2025-30012 · Grafana+2 · Grafana Oss+2

Hoa X. Nguyen

·

Published

2025-06-11

·

Updated

2026-02-01

·

CVE-2025-6023

CVSS v3.1

7.6

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Name of the Vulnerable Software and Affected Versions Grafana versions 11.3.8 through 11.6.3 Grafana versions 11.4.6 through 11.5.6 Grafana versions 11.5.0 through 11.5.6 Grafana versions prior to 12.0.2+security-01 Grafana versions prior to 1.9.2-0.20250521205822-0ba0b99665a9
Description Grafana OSS is susceptible to open redirect vulnerabilities that can be leveraged to carry out Cross-Site Scripting (XSS) attacks. The vulnerability was introduced in version 11.5.0 and can be combined with path traversal vulnerabilities to achieve XSS. The vulnerability stems from insufficient protection of the web page structure, allowing a remote attacker to redirect users to arbitrary websites. No information is available regarding the number of potentially affected devices or any real-world incidents where this issue has been exploited. The vulnerability can be exploited through open redirects and path traversal. The vulnerable component is the redirection mechanism within Grafana.
Recommendations Update to Grafana version 12.0.2+security-01. Update to Grafana version 11.6.3+security-01. Update to Grafana version 11.5.6+security-01. Update to Grafana version 11.4.6+security-01. Update to Grafana version 11.3.8+security-01. Update to Grafana version 1.9.2-0.20250521205822-0ba0b99665a9 or later.

Fix

Information Disclosure

XSS

Open Redirect

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2025-10637
ALT-PU-2025-10789
BDU:2025-08873
BDU:2025-08910
BDU:2025-09887
BIT-GRAFANA-2025-6023
CVE-2025-6023
ECHO-FCDF-A20F-1AD6
GHSA-VQPH-P5VC-G644
GO-2025-3817
OPENSUSE-SU-2025:15372-1
OPENSUSE-SU-2025:15405-1
SUSE-SU-2025:3817-1
SUSE-SU-2025:3819-1
SUSE-SU-2025:4457-1
SUSE-SU-2025:4458-1
SUSE-SU-2025:4482-1

Affected Products

Alt Linux
Grafana Oss
Red Os