6.8
CVE-2025-2703
- EPSS 0.01%
- Published 23.04.2025 11:36:02
- Last modified 10.06.2025 11:15:52
- Source security@grafana.com
- Teams watchlist Login
- Open Login
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorGrafana
≫
Product
Grafana
Default Statusunaffected
Version <
11.6.0+security-01
Version
11.6.0
Status
affected
Version <
11.5.3+security-01
Version
11.5.0
Status
affected
Version <
11.4.3+security-01
Version
11.4.0
Status
affected
Version <
11.3.5+security-01
Version
11.3.0
Status
affected
Version <
11.2.8+security-01
Version
11.2.0
Status
affected
VendorGrafana
≫
Product
Grafana Enterprise
Default Statusunaffected
Version <
11.6.0+security-01
Version
11.6.0
Status
affected
Version <
11.5.3+security-01
Version
11.5.0
Status
affected
Version <
11.4.3+security-01
Version
11.4.0
Status
affected
Version <
11.3.5+security-01
Version
11.3.0
Status
affected
Version <
11.2.8+security-01
Version
11.2.0
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.01% | 0.01 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| security@grafana.com | 6.8 | 2.1 | 4.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.