CVE-2025-2703
Fixed in a distro release EPSS 16%CVSS 6.8
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.
Products: grafana, Grafana Enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | grafana | no fix |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | grafana | 11.5.5-150200.3.72.2 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | grafana | 11.5.5-150200.3.72.2 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | golang-github-prometheus-node_exporter | 1.9.1-1.36.2 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | golang-github-prometheus-node_exporter | 1.9.1-1.36.2 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-alertmanager | 0.26.0-1.31.2 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-node_exporter | 1.9.1-1.36.2 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-prometheus | 2.53.4-1.60.2 |
| SUSE Manager Client Tools 12 | grafana | 11.5.5-1.79.2 |
| SUSE Manager Client Tools 12 | prometheus-blackbox_exporter | 0.26.0-1.27.1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 2.53.4-150000.3.62.2 |
| SUSE Manager Client Tools 15 | grafana | 11.5.5-150000.1.79.1 |
| SUSE Manager Client Tools 15 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| SUSE Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| SUSE Manager Proxy Module 4.3 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| SUSE Manager Server 4.3 | release-notes-susemanager | 4.3.15.2-150400.3.133.1 |
| openSUSE Leap 15.6 | grafana | 11.5.5-150200.3.72.2 |
| openSUSE Leap 15.6 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| openSUSE Tumbleweed | grafana | 11.5.4-1.1 |