Threats tagged 'ghsa-q53q-gxq9-mgrj'

CVE-2025-4123 is a high-severity cross-site scripting (XSS) vulnerability in Grafana caused by a combination of client path traversal and open redirect. It allows attackers to redirect users to a malicious frontend plugin that executes arbitrary JavaScript. The vulnerability does not require editor permissions and can be exploited if anonymous access is enabled. The default Content-Security-Policy (CSP) in Grafana mitigates the XSS via the connect-src directive. If the Grafana Image Renderer plugin is installed, the open redirect can be leveraged for a full read SSRF attack. A patch is available in version 0.0.0-20250521183405-c7a690348df7.