« Volver al listado

CVE-2025-6023

Estado: AplazadaAlta (7.6)—

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.

The open redirect can be chained with path traversal vulnerabilities to achieve XSS.

Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS indica UI:R (interacción del usuario requerida) y el texto describe XSS a través de redirección abierta. T1189 es apropiado. Los impactos cubren ejecución de JavaScript en navegador (T1059.007) y phishing vía enlace malicioso (T1566.002).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentUser TrainingUser Account ManagementExecution PreventionBehavior Prevention on EndpointDisable or Remove Feature or Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Grafana — GrafanaAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-6023",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-6023",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-18T13:46:38.999015Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@grafana.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@grafana.com",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Grafana",
          "versions": [
            {
              "status": "affected",
              "version": "12.0.x",
              "lessThan": "12.0.2+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.6.x",
              "lessThan": "11.6.3+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.5.x",
              "lessThan": "11.5.6+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.4.x",
              "lessThan": "11.4.6+security-01",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.3.x",
              "lessThan": "11.3.8+security-01",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-18T08:15:28.040",
  "references": [
    {
      "url": "https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/",
      "source": "security@grafana.com"
    },
    {
      "url": "https://grafana.com/security/security-advisories/cve-2025-6023/",
      "source": "security@grafana.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@grafana.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.\n\nThe open redirect can be chained with path traversal vulnerabilities to achieve XSS.\n\nFixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01"
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad de redirección abierta en Grafana OSS que puede explotarse para realizar ataques XSS. Esta vulnerabilidad se introdujo en Grafana v11.5.0. La redirección abierta puede combinarse con vulnerabilidades de path traversal para lograr XSS. Corregida en las versiones 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 y 11.3.8+security-01."
    }
  ],
  "lastModified": "2026-06-17T10:01:00.937",
  "sourceIdentifier": "security@grafana.com"
}