CVE-2025-6023CWE-601CWE-79
An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks
High · published July 18, 2025
Patch now
High probability of exploitation
CVSS calls it high at 7.6. It sits in the 99.1th percentile for exploit probability.
What it is
An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.
The open redirect can be chained with path traversal vulnerabilities to achieve XSS.
Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01
The record
Technical detail
- CVSS v3.1
- 7.6 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.57743 · 99.1th percentile
- Weaknesses
- CWE-601 · URL Redirection to Untrusted Site ('Open Redirect'); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2025-07-18T07:48Z
EPSS history
Timeline