CVE-2025-4123 - CVE House
Back to Database
Status published High CVE-2025-4123

A cross-site scripting (XSS) vulnerability exists in Grafana caused by...

Vulnerability Description

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-4123

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Alvaro Balada

References

More from Grafana

View All →
CVE-2025-8341
SSRF in Infinity Datasource Plugin
Medium 5
CVE-2025-6197
An open redirect vulnerability has been identified in Grafana OSS...
Medium 4.2
CVE-2025-6023
An open redirect vulnerability has been identified in Grafana OSS...
High 7.6
CVE-2025-41118
Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Critical 9.1
CVE-2025-41117
XSS in Grafana Explore stack trace
Medium 6.8

Affected Vendor

Affected Software

Grafana
Vulnerable Versions:
10.4.18+security-01, 11.2.9+security-01, 11.3.6+security-01, 11.4.4+security-01, 11.5.4+security-01, 11.6.1+security-01, 12.0.0+security-01

Timeline

Official Publish: May 22nd, 2025
Last Modified: April 29th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Weaknesses (CWE)

CWE-79 CWE-601

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact
T1566 Phishing
Initial Access
T1204 User Execution
Execution
T1071 Application Layer Protocol
Command and Control
T1036 Masquerading
Defense Evasion