CVE-2025-6023

Published Jul 18, 2025

Last updated 5 months ago

Grafana OSS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-6023 is an open redirect vulnerability found in Grafana OSS that can be exploited to achieve cross-site scripting (XSS) attacks. The vulnerability was introduced in Grafana version 11.5.0. It was discovered on June 11, 2025, through Grafana's bug bounty program. The vulnerability combines client-side path traversal and open redirect mechanisms to enable XSS attacks. By crafting URLs with path traversal sequences or double slashes, attackers can bypass intended navigation controls and redirect users to malicious sites or load malicious resources. Successful exploitation could lead to session hijacking, account takeover, and access to sensitive dashboards. Unlike many XSS vulnerabilities, this one does not require editor permissions, making it particularly dangerous when anonymous access is enabled.

Description: An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01
Source: security@grafana.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.6
Impact score: 4.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Severity: HIGH

Weaknesses

security@grafana.com: CWE-79

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 3

References