grafana -- XSS vulnerability

2025-05-27 · CVE-2025-4123 · VuXML entry

[email protected] reports: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer …

Affected versions

• grafana >= 8.0.0 < 10.4.18+security-01; >= 11.0.0 < 11.2.9+security-01; >= 11.3.0 < 11.3.6+security-01; >= 11.4.0 < 11.4.4+security-01; >= 11.5.0 < 11.5.4+security-01; >= 11.6.0 < 11.6.1+security-01; >= 12.0.0 < 12.0.0+security-01
• grafana8 >= 8.0.0
• grafana9 >= 9.0.0

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.