CVE-2025-4123

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect (CVE-2025-4123)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect (CVE-2025-4123)

• grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect [rhel-9.6.z] (CVE-2025-4123)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect (CVE-2025-4123)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the connect-src directive.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect (CVE-2025-4123)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect (CVE-2025-4123)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.

The default Content-Security-Policy (CSP) in Grafana will block the XSS though the connect-src directive.

Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v0.0.0-20250521183405-c7a690348df7.

These are all security issues fixed in the grafana-11.6.1+security01-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the govulncheck-vulndb-0.0.20250527T204717-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Changes in grafana:

• Update to version 11.6.11: Features and enhancements:

  • Alerting: Add limits for the size of expanded notification templates
  • Correlations: Remove support for org_id=0 Security:
  • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)

• Update to version 11.6.10: Features and enhancements:

  • API: Add missing scope check on dashboards
  • Avatar: Require sign-in, remove queue, respect timeout Bug fixes:
  • Alerting: Fix a race condition panic in ResetStateByRuleUID

• Update to version 11.6.9: Features and enhancements:

  • Plugins: Add PluginContext to plugins when scenes is disabled Bug fixes:
  • Alerting: Fix contacts point issues

• Update to version 11.6.8: Bug fixes:

  • Alerting: Fix unmarshalling of GettableStatus to include time intervals

• Update to version 11.6.7: Bug fixes:

  • Auth: Fix render user OAuth passthrough
  • LDAP Authentication: Fix URL to propagate username context as parameter
  • Plugins: Dependencies do not inherit parent URL for preinstall
  • URLParams: Stringify true values as key=true always (fixes issues with variables with true value)

• Update to version 11.6.6: Bug fixes:

  • Alerting: Fix copying of recording rule fields
  • Fix redirection after login when Grafana is served from subpath

• Update to version 11.6.5: Features and enhancements:

  • Alerting: Bump alerting package to include change to NewTLSClient

• Update to version 11.6.4: Features and enhancements:

  • StateTimeline: Add endTime to tooltip
  • Unified storage: Respect GF_DATABASE_URL override Bug fixes:
  • Alerting: Fix group interval override when adding new rules
  • Azure: Fix legend formatting
  • Azure: Fix resource name determination in template variable queries
  • Graphite: Fix annotation queries
  • Graphite: Fix date mutation
  • Graphite: Fix nested variable interpolation for repeated rows

• Update to version 11.6.3: Security:

  • Fixes CVE-2025-3415

• Update to version 11.6.2: Bug fixes:

  • Dashboard: Fixes issue with row repeats and first row
  • Graphite: Ensure template variables are interpolated correctly
  • Graphite: Fix Graphite series interpolation
  • Prometheus: Fix semver import path

• Update to version 11.6.1: Features and enhancements:

  • DashboardScenePage: Correct slug in self referencing data links
  • GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
  • Prometheus: Add support for cloud partners Prometheus data sources Bug fixes:
  • Alertmanager: Add Role-Based Access Control via reqAction Field
  • GrafanaUI: Remove blurred background from overlay backdrops to improve performance
  • InfluxDB: Fix nested variable interpolation
  • LDAP test: Fix page crash
  • Org redirection: Fix linking between orgs

• Upgrade to version 11.6.0: Features and enhancements:

  • Visualisations: One click links and actions
  • Annotations: Add cron syntax support
  • WebGL-powered geomaps for better performance
  • Alerting: Add alert rule version history Security:
  • API keys: Migrate API keys to service accounts at startup

• CVE-2026-21721: Fix access control by the dashboard permissions API (bsc#1257337)

• CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)

• CVE-2025-68156: Fix potential DoS via unbounded recursion in builtin functions (bsc#1255340)

• CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (bsc#1254113)

• Use forked wire from Grafana repository instead of external package (jsc#PED-14178).

• Update to version 11.5.10: Security:

  • CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
  • CVE-2025-58190: Fix excessive memory consumption (bsc#1251657) Features and enhancements:
  • Update to Go 1.25
  • Update to golang.org/x/net v0.45.0 Bug fixes:
  • Auth: Fix render user OAuth…

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.15.2
  • SUSE Manager 4.3 will transition to LTS after June 2025
  • CVE Fixed CVE-2023-45288, CVE-2024-11741, CVE-2024-45337, CVE-2024-45339 CVE-2024-51744, CVE-2024-9264, CVE-2024-9476, CVE-2025-22870 CVE-2025-22872, CVE-2025-2703 CVE-2025-27144, CVE-2025-3454 CVE-2025-3580, CVE-2025-4123, CVE-2024-47535