vulnerability
Oracle Linux: CVE-2025-4123: ELSA-2025-7893: grafana security update (IMPORTANT) (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:L/Au:N/C:C/I:P/A:P) | May 15, 2025 | May 20, 2025 | May 26, 2025 |
Severity
9
CVSS
(AV:N/AC:L/Au:N/C:C/I:P/A:P)
Published
May 15, 2025
Added
May 20, 2025
Modified
May 26, 2025
Description
A flaw was found in Grafana's custom frontend plugin handling. This vulnerability allows an attacker to perform a cross-site scripting (XSS) attack by exploiting a client path traversal and an open redirect issue, leading to arbitrary JavaScript execution and potential user redirection to malicious websites. This attack can be carried out without requiring elevated privileges if anonymous access is enabled.
Solution(s)
oracle-linux-upgrade-grafanaoracle-linux-upgrade-grafana-selinux
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.