Skip to content

x/vulndb: potential Go vuln in github.com/grafana/grafana: GHSA-q53q-gxq9-mgrj #3704

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
GoVulnBot opened this issue May 22, 2025 · 1 comment
Open

x/vulndb: potential Go vuln in github.com/grafana/grafana: GHSA-q53q-gxq9-mgrj #3704

GoVulnBot opened this issue May 22, 2025 · 1 comment
Assignees
@thatnealpatel
Labels
triaged

Comments

@GoVulnBot
Copy link

Advisory GHSA-q53q-gxq9-mgrj references a vulnerability in the following Go modules:

Module
github.com/grafana/grafana

Description:
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.

The default Content-Security-Policy (CSP) in Grafana will block the XSS though the connect-src directive.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/grafana/grafana
      non_go_versions:
        - fixed: 0.0.0-20250521183405-c7a690348df7
      vulnerable_at: 5.4.5+incompatible
summary: Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana
cves:
    - CVE-2025-4123
ghsas:
    - GHSA-q53q-gxq9-mgrj
references:
    - advisory: https://github.com/advisories/GHSA-q53q-gxq9-mgrj
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-4123
    - fix: https://github.com/grafana/grafana/commit/c7a690348df761d41b659224cbc50a46a0c0e4cc
    - web: https://grafana.com/security/security-advisories/cve-2025-4123
source:
    id: GHSA-q53q-gxq9-mgrj
    created: 2025-05-22T19:03:26.491496068Z
review_status: UNREVIEWED
@thatnealpatel thatnealpatel self-assigned this May 23, 2025
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/675876 mentions this issue: data/reports: add 4 reports

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@thatnealpatel thatnealpatel

Labels
triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@gopherbot @thatnealpatel @GoVulnBot