CVE-2025-6023: XSS
An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.
The open redirect can be chained with path traversal vulnerabilities to achieve XSS.
Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/grafana/grafanato a version that resolves this vulnerability.Fixed in 1.9.2-0.20250521205822-0ba0b99665a9 - Upgrade
Upgrade
Grafana OSSto a version that resolves this vulnerability.Fixed in 12.0.2+security-01 - Upgrade
Upgrade
Grafana OSSto a version that resolves this vulnerability.Fixed in 11.6.3+security-01 - Upgrade
Upgrade
Grafana OSSto a version that resolves this vulnerability.Fixed in 11.5.6+security-01 - Upgrade
Upgrade
Grafana OSSto a version that resolves this vulnerability.Fixed in 11.4.6+security-01 - Upgrade
Upgrade
Grafana OSSto a version that resolves this vulnerability.Fixed in 11.3.8+security-01
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6023?
CVE-2025-6023 is considered a medium severity vulnerability due to its potential to facilitate XSS attacks.
How do I fix CVE-2025-6023?
To fix CVE-2025-6023, upgrade to Grafana versions 12.0.2+security-01 or 11.6.3+security-01.
What can exploit CVE-2025-6023?
CVE-2025-6023 can be exploited through open redirects and path traversal vulnerabilities to conduct XSS attacks.
Which versions of Grafana are affected by CVE-2025-6023?
Grafana versions starting from 11.5.0 are affected by CVE-2025-6023.
Is CVE-2025-6023 present in Grafana OSS prior to version 11.5.0?
CVE-2025-6023 is not present in Grafana OSS versions prior to 11.5.0.