CVE-2025-2703
Medium · 6.8CVSS
6.8
EPSS
16.0%
Published
Apr 23, 2025
CISA due date
—
The record
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | grafana | 11.2.0 | 11.5.3 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | grafana | 0 | 11.5.5-150200.3.72.2 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | grafana | 0 | 11.5.5-150200.3.72.2 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | golang-github-prometheus-node_exporter | 0 | 1.9.1-1.36.2 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | golang-github-prometheus-node_exporter | 0 | 1.9.1-1.36.2 |
| SUSE:Manager Client Tools 12 | golang-github-prometheus-alertmanager | 0 | 0.26.0-1.31.2 |
| SUSE:Manager Client Tools 12 | golang-github-prometheus-node_exporter | 0 | 1.9.1-1.36.2 |
| SUSE:Manager Client Tools 12 | golang-github-prometheus-prometheus | 0 | 2.53.4-1.60.2 |
| SUSE:Manager Client Tools 12 | grafana | 0 | 11.5.5-1.79.2 |
| SUSE:Manager Client Tools 12 | prometheus-blackbox_exporter | 0 | 0.26.0-1.27.1 |
| SUSE:Manager Client Tools 15 | golang-github-prometheus-prometheus | 0 | 2.53.4-150000.3.62.2 |
| SUSE:Manager Client Tools 15 | grafana | 0 | 11.5.5-150000.1.79.1 |
| SUSE:Manager Client Tools 15 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.27.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.27.1 |
| SUSE:Manager Proxy Module 4.3 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.27.1 |
| SUSE:Manager Server 4.3 | release-notes-susemanager | 0 | 4.3.15.2-150400.3.133.1 |
| openSUSE:Leap 15.6 | grafana | 0 | 11.5.5-150200.3.72.2 |
| openSUSE:Leap 15.6 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.27.1 |
| openSUSE:Tumbleweed | grafana | 0 | 11.5.4-1.1 |
Related vulnerabilities
- CVE-2025-41115 Grafana Incorrect Privilege Assignment vulnerability Also affects grafana
- CVE-2025-6023 An open redirect vulnerability has been identified in Grafana OSS that can be exploited… Also affects grafana
- CVE-2025-6197 An open redirect vulnerability has been identified in Grafana OSS organization switching… Also affects grafana
- CVE-2025-4123 A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client… Also affects grafana
- CVE-2024-10452 Grafana org admin can delete pending invites in different org Also affects grafana
- CVE-2024-9264 Grafana Command Injection And Local File Inclusion Via Sql Expressions Also affects grafana
- CVE-2024-6322 Access control for plugin data sources protected by the ReqActions json field of the… Also affects grafana
- CVE-2024-1313 It is possible for a user in a different organization from the owner of a snapshot to… Also affects grafana