CVE-2025-6023

A Cross-site scripting (XSS) vulnerability was found in Grafana caused by client path traversal and open redirect. This flaw allows attackers to redirect users to malicious websites that execute arbitrary JavaScript code in scripted dashboards. Unlike many other XSS vulnerabilities, this vulnerability does not require editor permissions. If anonymous access is enabled, the XSS attack will be successful.

No Red Hat products or offerings are affected by this vulnerability. As the version of grafana (9.2.10/10.2.6) shipped in this version of Red Hat Enterprise Linux is not vulnerable to this CVE. The vulnerable versions listed in the CVE posting are 12.0.x, 11.6.x, 11.5.x, 11.4.x, and 11.3.x, which are all not in Red Hat Enterprise Linux.

This vulnerability is Important because it combines two high-impact vectors—open redirect and stored/reflected XSS—without the common mitigation of requiring elevated permissions. The lack of an editor-role requirement drastically expands the attack surface, enabling exploitation by any unauthenticated attacker if anonymous access is enabled. In Grafana deployments that allow public or wide internal access, an attacker could craft a malicious link that both redirects users to attacker-controlled domains and executes arbitrary JavaScript in scripted dashboards. This can directly lead to session hijacking, credential theft, or full account compromise, potentially allowing an attacker to modify dashboards, extract sensitive data from Grafana data sources, or pivot into connected systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.