Sunday, 20 July, 2025
Critical Grafana Flaws Enable Malicious Redirects & Code Execution, Patch Immediately
Two severe vulnerabilities, CVE‑2025‑6023 and CVE‑2025‑6197, have been discovered in Grafana versions 11.3–12.0. Attackers can exploit an XSS flaw via open redirects and path traversal to execute arbitrary JavaScript—without needing editor rights—leading to session hijacking and account takeover. A medium-grade open-redirect bug in organization switching could also escalate attacks. Grafana Labs has released security updates; users must upgrade or apply CSP policy and ingress fixes immediately.
Read full story at Cybersecurity News