A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

redhat RHSA-2025:8680: RHSA-2025:8680: grafana security update (Important)

redhat RHSA-2025:8683: RHSA-2025:8683: grafana security update (Important)

redhat RHSA-2025:8679: RHSA-2025:8679: grafana security update (Important)

redhat RHSA-2025:8685: RHSA-2025:8685: grafana security update (Important)

redhat RHSA-2025:8681: RHSA-2025:8681: grafana security update (Important)

redhat RHSA-2025:8684: RHSA-2025:8684: grafana security update (Important)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8665 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect     (CVE-2025-4123)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7892 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect     (CVE-2025-4123)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Grafana install hosted on the remote host is earlier than 10.4.18, or 11.2.x earlier than 11.2.9, or 11.3.x earlier than 11.3.6, or 11.4.x earlier than 11.4.4, or 11.5.x earlier than 11.5.4, or 11.6.x earlier than 11.6.1. It is, therefore, affected by a cross-site scripting vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 45eb98d6-3b13-11f0-97f7-b42e991fc52e advisory.

    security@grafana.com reports:
    A cross-site scripting (XSS) vulnerability exists in Grafana caused             by combining a client path traversal and open redirect.  This allows             attackers to redirect users to a website that hosts a frontend             plugin that will execute arbitrary JavaScript.  This vulnerability             does not require editor permissions and if anonymous access is             enabled, the XSS will work.  If the Grafana Image Renderer plugin             is installed, it is possible to exploit the open redirect to achieve             a full read SSRF.

            The default Content-Security-Policy (CSP) in Grafana will block the             XSS though the `connect-src` directive.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7894 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect     (CVE-2025-4123)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7893 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect     (CVE-2025-4123)

    * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect     [rhel-9.6.z] (CVE-2025-4123)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0074 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-4123:
    A flaw was found in Grafana's custom frontend plugin handling. This vulnerability allows an attacker to     perform a cross-site scripting (XSS) attack by exploiting a client path traversal and an open redirect     issue, leading to arbitrary JavaScript execution and potential user redirection to malicious websites.
    This attack can be carried out without requiring elevated privileges if anonymous access is enabled.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:7893 advisory.

    * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect     (CVE-2025-4123)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7893 advisory.

    - Resolves RHEL-89954: CVE-2025-4123
    - Resolves RHEL-84636: CVE-2025-30204

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:7894 advisory.

    * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect     (CVE-2025-4123)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7894 advisory.

    [9.2.10-23]
    - Resolves RHEL-89949: CVE-2025-4123

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237979	RHEL 9 : grafana (RHSA-2025:8665)	Nessus	Red Hat Local Security Checks	critical
237846	RHEL 10 : grafana (RHSA-2025:7892)	Nessus	Red Hat Local Security Checks	high
114816	Grafana 11.6.x < 11.6.1 Cross-site Scripting	Web App Scanning	Component Vulnerability	high
114815	Grafana 11.5.x < 11.5.4 Cross-site Scripting	Web App Scanning	Component Vulnerability	high
114814	Grafana 11.4.x < 11.4.4 Cross-site Scripting	Web App Scanning	Component Vulnerability	high
114813	Grafana 11.3.x < 11.3.6 Cross-site Scripting	Web App Scanning	Component Vulnerability	high
114812	Grafana 11.2.x < 11.2.9 Cross-site Scripting	Web App Scanning	Component Vulnerability	high
114811	Grafana < 10.4.18 Cross-site Scripting	Web App Scanning	Component Vulnerability	high
237401	FreeBSD : grafana -- XSS vulnerability (45eb98d6-3b13-11f0-97f7-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	high
237366	RHEL 8 : grafana (RHSA-2025:7894)	Nessus	Red Hat Local Security Checks	high
237363	RHEL 9 : grafana (RHSA-2025:7893)	Nessus	Red Hat Local Security Checks	high
237276	Alibaba Cloud Linux 3 : 0074: grafana (ALINUX3-SA-2025:0074)	Nessus	Alibaba Cloud Linux Local Security Checks	high
237232	AlmaLinux 9 : grafana (ALSA-2025:7893)	Nessus	Alma Linux Local Security Checks	high
237179	Oracle Linux 9 : grafana (ELSA-2025-7893)	Nessus	Oracle Linux Local Security Checks	high
236980	AlmaLinux 8 : grafana (ALSA-2025:7894)	Nessus	Alma Linux Local Security Checks	high
236945	Oracle Linux 8 : grafana (ELSA-2025-7894)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2025-4123

high

Tenable Plugins

Coming Soon

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high