CVE-2025-4123

mediumPriorität · beachten · 68EPSS 0.971 · 100. PerzentilExploit · PoCDEEURUUS
grimoire priorityP1 · Urgent
Exploitable?
Public exploit
6 exploits · PoC
Likely / severe?
97.1% (100th) EPSS
CVSS 6.1 · medium
Is it mine?
60 products
Prüfe deine Angriffsfläche
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-24

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenSICK Incoming Goods Suite with Firmware <1.2.1sick_psirt

    Users are strongly recommended to upgrade to the latest release of Incoming Goods Suite (>= 1.2.1).

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.3
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.1–8.3

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.7
v3.17.6highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · FSTEC (BDU) RU
v3.17.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · ENISA EU
v3.17.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · security@grafana.comAusnutzbarkeit 2.8 · Auswirkung 4.7
v3.17.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · OSV
v3.18.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondary · SICK PSIRT DE
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Hsecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-601USCWE-601USCWE-79USCWE-79USCWE-79US
05

Exploits (6)

Öffentlicher Proof-of-Concept- und Exploit-Code.

06

betroffene Produkte (60)

Betroffene Produkte und Versionsbereiche.

20 von 60 angezeigt
07

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

  • SCA-2026-0002Vulnerabilities affecting SICK Incoming Goods Suite2026-01-15csaf · sick_psirtDE

    SICK has identified multiple vulnerabilities in the SICK Incoming Goods Suite product. Vulnerabilities related to Grafana apply exclusively to the administrative user interface for log management and do not affect the Incoming Goods Suite user interface. The vulnerabilities could potentially affect the confidentiality, integrity an availability of the product. Therefore it is strongly recommended to apply general security practices when operating the product.

  • WID-SEC-W-2025-1096Grafana: Schwachstelle ermöglicht Cross-Site ScriptingDeutsch2025-05-18csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

  • GHSA-q53q-gxq9-mgrjGrafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin2025-05-22ghsa · osvUS

    A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

  • BIT-grafana-2025-41232025-05-26vendor · osvUS

    A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

  • GO-2025-3704Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana2025-05-27vendor · osvUS

    Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/grafana/grafana before v0.0.0-20250521183405-c7a690348df7.

08

auch bekannt als (7)

Weitere Namen und Kennungen dieser Entität.

09

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduosvcert_bundsick_psirtNVDCVE.orgMITRE
veröffentlicht 2025-05-22geändert 2026-06-17
10

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan