{"basis":"claimed","id":"CVE-2025-4123","name":"Grafana Grafana","vendorProject":"Grafana","product":"Grafana","publishedAt":"2025-05-22","cvss":{"score":7.6,"severity":"HIGH","version":"3.1"},"exploited":null,"epss":{"score":0.97083,"percentile":0.99892,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-08-04","daysToRule":74},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-08-15","daysToRule":85},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.\n\nThe default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.","cwes":["CWE-79","CWE-601"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-08-04","firstIsNew":true,"daysToRule":74,"daysAtMost":null,"freePlan":false,"claims":[{"id":"9193d88de5f1ec4a898529eb9a04290dd4891f0c80119a8ae472b10522addc79","cve_id":"CVE-2025-4123","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"f71ce87ea6e54eab999223df579cd3e0","rule_name":"Grafana - Directory Traversal - CVE:CVE-2025-4123","change":"new","default_action":"Block","published_on":"2025-08-04","source_url":"https://developers.cloudflare.com/changelog/post/2025-08-04-waf-release/","source_title":"WAF Release - 2025-08-04","excerpt":"Grafana - Directory Traversal - CVE:CVE-2025-4123. Previous action: Log. New action: Block. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.350Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-08-15","firstIsNew":true,"daysToRule":85,"daysAtMost":null,"freePlan":false,"claims":[{"id":"cefcfb2b5c1b8276005df904d3c17bb6cfc1d6388b9fb5708c3cc813abcd86fe","cve_id":"CVE-2025-4123","vendor":"f5","product":"Attack signatures","rule_id":"200007096","rule_name":"Grafana Path Traversal","change":"new","default_action":null,"published_on":"2025-08-15","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200007096 \"Grafana Path Traversal\" (Path Traversal, risk High), systems: Other Web Server. References: CVE-2025-4123.","first_seen_at":"2026-11-02T21:00:25.702Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:16:34.613Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2025-4123","templatePath":"http/cves/2025/CVE-2025-4123.yaml","requests":2,"blockedRequests":2,"rules":["930100","930110"],"note":"","requestDetail":[{"method":"GET","path":"/render/public/..%252f%255Coast.invalid%252f%253F%252f..%252f..","status":403,"blocked":true,"rules":["930100"]},{"method":"GET","path":"/public/..%2F%5coast.pro%2F%3f%2F..%2F..","status":403,"blocked":true,"rules":["930100","930110"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2025-4123","templatePath":"http/cves/2025/CVE-2025-4123.yaml","requests":2,"blockedRequests":2,"rules":["930100","930110"],"note":"","requestDetail":[{"method":"GET","path":"/render/public/..%252f%255Coast.invalid%252f%253F%252f..%252f..","status":403,"blocked":true,"rules":["930100"]},{"method":"GET","path":"/public/..%2F%5coast.pro%2F%3f%2F..%2F..","status":403,"blocked":true,"rules":["930100","930110"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}