Name of the Vulnerable Software and Affected Versions:

Grafana OSS versions 11.5.0 through 11.5.5

Grafana OSS versions 11.6.0 through 11.6.2

Grafana OSS versions 11.4.0 through 11.4.5

Grafana OSS versions 11.3.0 through 11.3.7

Description:

An open redirect vulnerability exists in Grafana OSS that can be exploited to achieve cross-site scripting (XSS) attacks. The vulnerability was introduced in Grafana version 11.5.0. The open redirect can be combined with path traversal vulnerabilities to achieve XSS.

Recommendations:

Update to Grafana OSS version 12.0.2+security-01.

Update to Grafana OSS version 11.6.3+security-01.

Update to Grafana OSS version 11.5.6+security-01.

Update to Grafana OSS version 11.4.6+security-01.

Update to Grafana OSS version 11.3.8+security-01.