CVE-2025-4123
100Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 7.6epss 98%
de la publicación al arma0 días
Publicada en NVD22 may
1ª PoC22 may
VulnCheck+60d
probabilidad de explotación
98%top 1% de las CVE
explotación observada
síVulnCheck
14 exploit(s) público(s)
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.
The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Productos afectados
Grafana · GrafanaPoCs públicas encontradas — 14
cve_referencewww.exploit-db.com/exploits/52491no verificadogithubgithub.com/NightBloodZ/CVE-2025-4123★ 57githubgithub.com/ynsmroztas/CVE-2025-4123-Exploit-Tool-Grafana-★ 32githubgithub.com/punitdarji/Grafana-cve-2025-4123★ 2githubgithub.com/ItsNee/Grafana-CVE-2025-4123-POC★ 0githubgithub.com/imbas007/CVE-2025-4123-template★ 0vulncheckvulncheck.com/xdb/8c02d1b8b8c6no verificadovulncheckvulncheck.com/xdb/ece5d3ededdfno verificadovulncheckvulncheck.com/xdb/c4a8ba8ceceeno verificadovulncheckvulncheck.com/xdb/5fce5ba4f389no verificadovulncheckvulncheck.com/xdb/ff2d262ed849no verificadovulncheckvulncheck.com/xdb/6181c8d4da9eno verificadovulncheckvulncheck.com/xdb/2743693a194cno verificadovulncheckvulncheck.com/xdb/df1e63b26663no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.