Skip to content
OpenAdvisories
High WID-SEC-2025-0867 3 CVEs

Grafana: Mehrere Schwachstellen

Published Apr 22, 2025 · Updated May 3, 2026 · Revision 4 · de-DE

Vendor: Grafana Vendor: SUSE Product: Grafana Product: Linux Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder Informationen auszuspähen.

Product

Grafana ist eine Open-Source Analyse- und Visualisierungssoftware.

Vulnerabilities 3

  • High 8.3
    CVE-2025-3260

    Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

    A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Medium 6.8
    CVE-2025-2703 EPSS 16%

    The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify…

    Grafana Grafana Grafana Enterprise grafana Web / CMS Alpine
  • Medium 5.0
    CVE-2025-3454

    Grafana's datasource proxy API allows authorization checks to be bypassed

    This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometh…

    Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu Alpine Go

Revision history

  1. #4

    Neue Updates von openSUSE aufgenommen

  2. #3

    Neue Updates von SUSE aufgenommen

  3. #2

    Neue Updates von openSUSE aufgenommen

  4. #1

    Initiale Fassung

References