{"schemaVersion":3,"id":"CVE-2025-4123","aliases":["RHSA-2025:7892","RHSA-2025:7893","RHSA-2025:7894","RHSA-2025:8679","RHSA-2025:8681","RHSA-2025:8683","RHSA-2025:8684","UBUNTU-CVE-2025-4123","GHSA-q53q-gxq9-mgrj","BIT-grafana-2025-4123","GO-2025-3704","CGA-29cp-fr2m-g875","CGA-35g9-rpmp-xvvq","CGA-3hmp-c74v-3ph5","CGA-3hvq-68xw-7c5m","CGA-3rmq-4rp5-q2x7","CGA-3vjq-569m-j7wf","CGA-52h5-wq4x-3jhv","CGA-58j4-pw95-75fm","CGA-64hc-3r5q-2933","CGA-6qr6-q7hj-66vr","CGA-6rhg-q924-rg2h","CGA-79cg-qhrj-76pp","CGA-8429-ghpm-f8pm","CGA-87v7-vvjm-5qqh","CGA-8h8f-3jxm-4h9v","CGA-94pf-8vwx-j25j","CGA-9rjm-x7jm-qv45","CGA-9xrm-2v95-458v","CGA-c2vg-cvr7-rvqm","CGA-c783-qmmr-w2w6","CGA-c7mw-r2c7-hhhh","CGA-cc5j-gwmc-c8hp","CGA-ff2p-jhvg-h84h","CGA-fgpx-fcc6-5mxh","CGA-fm29-hv26-3765","CGA-frhc-9c9w-6p79","CGA-gwf8-cjg3-6f3c","CGA-h46g-fcpj-pmm4","CGA-jx2j-8cmp-3rwj","CGA-m3f4-g77g-7x44","CGA-mqgf-vg7c-pmx8","CGA-pj32-cpcw-4mq2","CGA-qq53-c7wv-m2rg","CGA-v9wc-97gv-v565","CGA-vcp7-h7v3-fcw9","CGA-vhg3-cf44-r696","CGA-wf5r-6wfm-8grg","CGA-wrm9-qxjc-vhj8","CGA-x548-pr57-mwq8","CGA-x6v3-7978-hgw3"],"status":"published","duplicateOf":null,"title":null,"description":"A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.\n\nThe default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.","dates":{"published":"2025-05-22T07:44:09.491Z","modified":"2026-04-29T19:56:35.801Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.6,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.6,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Red hat","score":7.6,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","exploitability":7.2,"impact":7.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":7.6,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","exploitability":7.2,"impact":7.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.6,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","exploitability":7.2,"impact":7.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.97083,"percentile":0.99893,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.07599999999999829,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.97007},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.97083,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.97083,"percentile":0.99893}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.97007,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.97083,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.97083,"percentile":0.99893}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"52491","name":"Grafana 11.6.0 - SSRF","source":"exploit-database","url":"https://www.exploit-db.com/exploits/52491","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"multiple","file":"exploits/multiple/webapps/52491.txt","codes":["CVE-2025-4123"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"},{"id":"CWE-601","name":"URL Redirection to Untrusted Site ('Open Redirect')","description":"The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Low","url":"https://cwe.mitre.org/data/definitions/601.html"}],"affected":[{"vendor":"chainguard","product":"grafana-fips-11.6","name":"grafana-fips-11.6","label":"grafana-fips-11.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-11.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.0","name":"grafana-fips-12.0","label":"grafana-fips-12.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.0","purlType":"apk","versions":[{"text":"< 12.0.10-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.0.10-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.1","name":"grafana-fips-12.1","label":"grafana-fips-12.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.1","purlType":"apk","versions":[{"text":"< 12.1.10.01-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.1.10.01-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.2","name":"grafana-fips-12.2","label":"grafana-fips-12.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.3","name":"grafana-fips-12.3","label":"grafana-fips-12.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.4","name":"grafana-fips-12.4","label":"grafana-fips-12.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-13.0","name":"grafana-fips-13.0","label":"grafana-fips-13.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-13.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-13.1","name":"grafana-fips-13.1","label":"grafana-fips-13.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-13.1","purlType":"apk","versions":[{"text":"< 13.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.1.0-r0","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"grafana","name":"grafana","label":"grafana","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/grafana","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/grafana","product":"grafana","name":"github.com/grafana/grafana","label":"grafana","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/grafana/grafana","purlType":"golang","versions":[{"text":"< 0.0.0-20250521183405-c7a690348df7","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 0.0.0-20250521183405-c7a690348df7 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"grafana","product":"grafana","name":"grafana","label":"grafana","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 10.4.18+security-01, < 10.4.19","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.2.9+security-01, < 11.2.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.3.6+security-01, < 11.3.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.4.4+security-01, < 11.4.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.5.4+security-01, < 11.5.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.6.1+security-01, < 11.6.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.0.0+security-01, < 12.0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 10.4.18","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.2.0, < 11.2.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.3.0, < 11.3.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.4.0, < 11.4.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.5.0, < 11.5.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.6.0, < 11.6.1","noFixRecorded":false,"fixedIn":null},{"text":"10.4.18","noFixRecorded":false,"fixedIn":null},{"text":"11.2.9","noFixRecorded":false,"fixedIn":null},{"text":"11.3.6","noFixRecorded":false,"fixedIn":null},{"text":"11.4.4","noFixRecorded":false,"fixedIn":null},{"text":"11.5.4","noFixRecorded":false,"fixedIn":null},{"text":"11.6.1","noFixRecorded":false,"fixedIn":null},{"text":"12.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.4.18+security-01, < 10.4.19 | ≥ 11.2.9+security-01, < 11.2.10 | ≥ 11.3.6+security-01, < 11.3.7 | ≥ 11.4.4+security-01, < 11.4.5 | ≥ 11.5.4+security-01, < 11.5.5 | ≥ 11.6.1+security-01, < 11.6.2 | ≥ 12.0.0+security-01, < 12.0.1 | < 10.4.18 | ≥ 11.2.0, < 11.2.9 | ≥ 11.3.0, < 11.3.6 | ≥ 11.4.0, < 11.4.4 | ≥ 11.5.0, < 11.5.4 | ≥ 11.6.0, < 11.6.1 | 10.4.18 | 11.2.9 | 11.3.6 | 11.4.4 | 11.5.4 | 11.6.1 | 12.0.0","eol":{"isEol":true,"eolDate":"2025-06-05T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"10.4","label":"10.4","eolFrom":"2025-06-05T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"10.4.19+security-01"},"product":{"name":"grafana","label":"Grafana","category":"server-app"}},"hubHref":"/vendor/grafana/grafana"},{"vendor":"redhat","product":"grafana","name":"grafana","label":"grafana","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana","purlType":"rpm","versions":[{"text":"< 0:10.2.6-17.el10_0","noFixRecorded":false,"fixedIn":null},{"text":"< 0:10.2.6-13.el9_6","noFixRecorded":false,"fixedIn":null},{"text":"< 0:9.2.10-23.el8_10","noFixRecorded":false,"fixedIn":null},{"text":"< 0:7.5.11-6.el8_6","noFixRecorded":false,"fixedIn":null},{"text":"< 0:7.5.11-10.el9_0","noFixRecorded":false,"fixedIn":null},{"text":"< 0:7.3.6-9.el8_4","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:10.2.6-17.el10_0 | < 0:10.2.6-13.el9_6 | < 0:9.2.10-23.el8_10 | < 0:7.5.11-6.el8_6 | < 0:7.5.11-10.el9_0 | < 0:7.3.6-9.el8_4 | < 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-azure-monitor","name":"grafana-azure-monitor","label":"grafana-azure-monitor","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-azure-monitor","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-cloudwatch","name":"grafana-cloudwatch","label":"grafana-cloudwatch","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-cloudwatch","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-debuginfo","name":"grafana-debuginfo","label":"grafana-debuginfo","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-debuginfo","purlType":"rpm","versions":[{"text":"< 0:10.2.6-17.el10_0","noFixRecorded":false,"fixedIn":null},{"text":"< 0:10.2.6-13.el9_6","noFixRecorded":false,"fixedIn":null},{"text":"< 0:9.2.10-23.el8_10","noFixRecorded":false,"fixedIn":null},{"text":"< 0:7.5.11-6.el8_6","noFixRecorded":false,"fixedIn":null},{"text":"< 0:7.5.11-10.el9_0","noFixRecorded":false,"fixedIn":null},{"text":"< 0:7.3.6-9.el8_4","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:10.2.6-17.el10_0 | < 0:10.2.6-13.el9_6 | < 0:9.2.10-23.el8_10 | < 0:7.5.11-6.el8_6 | < 0:7.5.11-10.el9_0 | < 0:7.3.6-9.el8_4 | < 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-debugsource","name":"grafana-debugsource","label":"grafana-debugsource","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-debugsource","purlType":"rpm","versions":[{"text":"< 0:10.2.6-17.el10_0","noFixRecorded":false,"fixedIn":null},{"text":"< 0:10.2.6-13.el9_6","noFixRecorded":false,"fixedIn":null},{"text":"< 0:9.2.10-23.el8_10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:10.2.6-17.el10_0 | < 0:10.2.6-13.el9_6 | < 0:9.2.10-23.el8_10","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-elasticsearch","name":"grafana-elasticsearch","label":"grafana-elasticsearch","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-elasticsearch","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-graphite","name":"grafana-graphite","label":"grafana-graphite","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-graphite","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-influxdb","name":"grafana-influxdb","label":"grafana-influxdb","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-influxdb","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-loki","name":"grafana-loki","label":"grafana-loki","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-loki","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-mssql","name":"grafana-mssql","label":"grafana-mssql","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-mssql","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-mysql","name":"grafana-mysql","label":"grafana-mysql","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-mysql","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-opentsdb","name":"grafana-opentsdb","label":"grafana-opentsdb","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-opentsdb","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-postgres","name":"grafana-postgres","label":"grafana-postgres","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-postgres","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-prometheus","name":"grafana-prometheus","label":"grafana-prometheus","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-prometheus","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-selinux","name":"grafana-selinux","label":"grafana-selinux","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-selinux","purlType":"rpm","versions":[{"text":"< 0:10.2.6-17.el10_0","noFixRecorded":false,"fixedIn":null},{"text":"< 0:10.2.6-13.el9_6","noFixRecorded":false,"fixedIn":null},{"text":"< 0:9.2.10-23.el8_10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:10.2.6-17.el10_0 | < 0:10.2.6-13.el9_6 | < 0:9.2.10-23.el8_10","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-stackdriver","name":"grafana-stackdriver","label":"grafana-stackdriver","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-stackdriver","purlType":"rpm","versions":[{"text":"< 0:6.3.6-7.el8_2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-7.el8_2","eol":null,"hubHref":null}],"affectedCount":27,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://grafana.com/security/security-advisories/cve-2025-4123/","label":"grafana.com/security/security-advisories/cve-2025-4123/","hostname":"grafana.com","tags":["Vendor Advisory","Advisory"]},{"url":"https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/","label":"grafana.com/blog/…","hostname":"grafana.com","tags":["Mitigation","Release Notes","Advisory","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/52491","label":"www.exploit-db.com/exploits/52491","hostname":"www.exploit-db.com","tags":["WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7892","label":"access.redhat.com/errata/RHSA-2025:7892","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2364632","label":"bugzilla.redhat.com/show_bug.cgi?id=2364632","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7892.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7892.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-4123","label":"access.redhat.com/security/cve/CVE-2025-4123","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-4123","label":"www.cve.org/CVERecord?id=CVE-2025-4123","hostname":"www.cve.org","tags":["Advisory","REPORT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4123","label":"nvd.nist.gov/vuln/detail/CVE-2025-4123","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://grafana.com/grafana/plugins/instana-datasource/?tab=changelog","label":"grafana.com/grafana/plugins/instana-datasource/?tab=changelog","hostname":"grafana.com","tags":["ARTICLE"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7893","label":"access.redhat.com/errata/RHSA-2025:7893","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7893.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7893.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7894","label":"access.redhat.com/errata/RHSA-2025:7894","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7894.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7894.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8679","label":"access.redhat.com/errata/RHSA-2025:8679","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8679.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8679.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8681","label":"access.redhat.com/errata/RHSA-2025:8681","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8681.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8681.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8683","label":"access.redhat.com/errata/RHSA-2025:8683","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8683.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8683.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8684","label":"access.redhat.com/errata/RHSA-2025:8684","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8684.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8684.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-4123","label":"ubuntu.com/security/CVE-2025-4123","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-4123","label":"bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-4123","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://github.com/grafana/grafana/commit/c7a690348df761d41b659224cbc50a46a0c0e4cc","label":"github.com/grafana/grafana/commit/c7a690348df761d41b659224cbc50a46a0c0e4cc","hostname":"github.com","tags":["WEB","FIX"]},{"url":"https://github.com/grafana/grafana","label":"github.com/grafana/grafana","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580","label":"grafana.com/blog/…","hostname":"grafana.com","tags":["WEB"]},{"url":"https://grafana.com/security/security-advisories/cve-2025-4123","label":"grafana.com/security/security-advisories/cve-2025-4123","hostname":"grafana.com","tags":["WEB"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3702","label":"pkg.go.dev/vuln/GO-2025-3702","hostname":"pkg.go.dev","tags":["WEB"]},{"url":"https://github.com/advisories/GHSA-q53q-gxq9-mgrj","label":"github.com/advisories/GHSA-q53q-gxq9-mgrj","hostname":"github.com","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4123.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4123.json","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2025:15171-1","OPENSUSE-SU-2025:15179-1","RHSA-2025:8665","RHSA-2025:8680","RHSA-2025:8685","SUSE-SU-2025:01985-1"],"duplicates":[],"related":["CGA-23GM-JQ6V-J2W7","CGA-M7JG-M2HG-P764","CGA-W8VP-454P-4X2M","OPENSUSE-SU-2025:15171-1","OPENSUSE-SU-2025:15179-1","SUSE-SU-2025:01985-1"]},"timeline":[{"kind":"published","date":"2025-05-22T07:44:09.491Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-29T19:56:35.801Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":60,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T13:11:31.683Z","stale":false,"partial":false}}