{"id":"CVE-2025-6023","published":"2025-07-18T07:48:15Z","modified":"2025-07-18T13:46:45Z","title":"An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks","vendor":"Grafana","product":"Grafana","tier":"core","eol":null,"affectedVersions":[{"vendor":"Grafana","product":"Grafana","versions":[">= 12.0.x, < 12.0.2+security-01",">= 11.6.x, < 11.6.3+security-01",">= 11.5.x, < 11.5.6+security-01",">= 11.4.x, < 11.4.6+security-01",">= 11.3.x, < 11.3.8+security-01"]}],"description":{"text":"An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.\n\nThe open redirect can be chained with path traversal vulnerabilities to achieve XSS.\n\nFixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01","provenance":"source","from":"CVE.org"},"summary":{"text":"An open redirect flaw in Grafana OSS, introduced in version 11.5.0, can be chained with path traversal vulnerabilities to produce cross-site scripting. An attacker can use this to run script in a victim's browser, and exploitation requires that the victim interact with a crafted link, with no authentication needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:15:58Z"},"cvss":{"score":7.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.57743,"percentile":0.99083,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Coordinated Grafana Exploitation Attempts on 28 September.","url":"https://otx.alienvault.com/pulse/68e2748876de95f2ff1413f4","created":"2025-10-05"}],"provenance":"machine"},"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"},{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2025-6023/","tags":["vendor-advisory"]},{"url":"https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/","tags":["release-notes","mitigation"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":["<1.9.2-0.20250521205822-0ba0b99665a9","all versions"],"patched":["1.9.2-0.20250521205822-0ba0b99665a9"],"from":["GHSA-vqph-p5vc-g644","GO-2025-3817"],"provenance":"source"}],"advisories":[{"id":"GHSA-vqph-p5vc-g644","url":"https://github.com/advisories/GHSA-vqph-p5vc-g644","severity":"HIGH","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":["<1.9.2-0.20250521205822-0ba0b99665a9"],"patched":["1.9.2-0.20250521205822-0ba0b99665a9"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-21861","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21861","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-07-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-6023","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9908"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.32,"detail":"base score 7.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2025-3260","published":"2025-06-02","fixed":"0.0.0-20250521183405-c7a690348df7","kev":false},{"cve":"CVE-2025-4123","published":"2025-05-22","fixed":"0.0.0-20250521183405-c7a690348df7","kev":false},{"cve":"CVE-2025-3415","published":"2025-07-17","fixed":"1.9.2-0.20250514160932-04111e9f2afd","kev":false,"link":{"from":"CVE-2025-3415","to":"CVE-2025-6023","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"1.9.2-0.20250514160932-04111e9f2afd","toFixed":"1.9.2-0.20250521205822-0ba0b99665a9","daysApart":1}]}},{"cve":"CVE-2025-6023","published":"2025-07-18","fixed":"1.9.2-0.20250521205822-0ba0b99665a9","kev":false},{"cve":"CVE-2026-21727","published":"2026-04-15","fixed":"1.9.2-0.20260127141016-e702db6096e0","kev":false},{"cve":"CVE-2026-21724","published":"2026-03-26","fixed":"1.9.2-0.20260323180334-daffe750de85","kev":false},{"cve":"CVE-2026-33380","published":"2026-05-13","fixed":"1.9.2-0.20260513165311-fb7336fc36c1","kev":false},{"cve":"CVE-2025-41115","published":"2025-11-21","fixed":"12.2.2","kev":false,"link":{"from":"CVE-2025-6023","to":"CVE-2025-41115","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"1.9.2-0.20250521205822-0ba0b99665a9","toFixed":"1.9.2-0.20251106142618-ca5d89812015","daysApart":126}]}}],"package":"Go:github.com/grafana/grafana"}}