# CVE-2025-4123: Grafana Grafana

- Exploited (CISA KEV): no
- Published: 2025-05-22
- CVSS: 7.6 HIGH (v3.1)
- EPSS: 97.1% (100th percentile)
- CWE: CWE-79, CWE-601

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.

The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-08-04 | 74 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-08-15 | 85 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-08-04 · new · rule f71ce87ea6e54eab999223df579cd3e0 · default Block
  > Grafana - Directory Traversal - CVE:CVE-2025-4123. Previous action: Log. New action: Block. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-08-04-waf-release/

### F5

- 2025-08-15 · new · rule 200007096
  > Added: signature 200007096 "Grafana Path Traversal" (Path Traversal, risk High), systems: Other Web Server. References: CVE-2025-4123.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: blocked (2 of 2 requests blocked), template CVE-2025-4123, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: blocked (2 of 2 requests blocked), template CVE-2025-4123, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-4123 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-4123