BIT-grafana-2025-2703

BIT-grafana-2025-2703 PUBLISHED CVSS 6.800000190734863 MEDIUM

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.

Risk Scores

CVSS 3.1

6.800000190734863

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Affected Products

Vendor	Product	Versions
Bitnami	grafana	11.2.0, 11.6.0, 11.2.0

Timeline

Apr 25, 2025 CVE Published
Jun 11, 2025 CVE Updated

References

https://grafana.com/security/security-advisories/cve-2025-2703 url
https://nvd.nist.gov/vuln/detail/CVE-2025-2703 url
https://www.sonarsource.com/blog/data-in-danger-detecting-xss-in-grafana-cve-2025-2703/ url

Open in Interactive Console →