CVE-2025-6023: An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks

Description

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

Low

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)57.7% · higher than 99% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

GR

Grafana · Grafana

12.0.x before 12.0.2+security-01; 11.6.x before 11.6.3+security-01; 11.5.x before 11.5.6+security-01; 11.4.x before 11.4.6+security-01; 11.3.x before 11.3.8+security-01 · source: vendor