The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0371 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-4123:
    A flaw was found in Grafana's custom frontend plugin handling. This vulnerability allows an attacker to     perform a cross-site scripting (XSS) attack by exploiting a client path traversal and an open redirect     issue, leading to arbitrary JavaScript execution and potential user redirection to malicious websites.
    This attack can be carried out without requiring elevated privileges if anonymous access is enabled.

    CVE-2024-45339:
    When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a     privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When     that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix     that, glog now causes the program to exit (with status code 2) when it finds that the configured log file     already exists.

    CVE-2024-45338:
    An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to     its length, resulting in extremely slow parsing. This could cause a denial of service.

    CVE-2025-22870:
    Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For     example, when the NO_PROXY environment variable is set to *.example.com, a request to     [::1%25.example.com]:80` will incorrectly match and not be proxied.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 45eb98d6-3b13-11f0-97f7-b42e991fc52e advisory.

    security@grafana.com reports:
    A cross-site scripting (XSS) vulnerability exists in Grafana caused             by combining a client path traversal and open redirect.  This allows             attackers to redirect users to a website that hosts a frontend             plugin that will execute arbitrary JavaScript.  This vulnerability             does not require editor permissions and if anonymous access is             enabled, the XSS will work.  If the Grafana Image Renderer plugin             is installed, it is possible to exploit the open redirect to achieve             a full read SSRF.

            The default Content-Security-Policy (CSP) in Grafana will block the             XSS though the `connect-src` directive.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7894 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect     (CVE-2025-4123)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal     and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that     will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous     access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to     exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in     Grafana will block the XSS though the `connect-src` directive. (CVE-2025-4123)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0458 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-4123:
    A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal     and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that     will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous     access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to     exploit the open redirect to achieve a full read SSRF.

    The default Content-Security-Policy (CSP) in Grafana will block the XSS though the connect-src directive.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007100 advisory.

    A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal     and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that     will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous     access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to     exploit the open redirect to achieve a full read SSRF.

    The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src`     directive.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:7894 advisory.

    * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect     (CVE-2025-4123)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0074 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-4123:
    A flaw was found in Grafana's custom frontend plugin handling. This vulnerability allows an attacker to     perform a cross-site scripting (XSS) attack by exploiting a client path traversal and an open redirect     issue, leading to arbitrary JavaScript execution and potential user redirection to malicious websites.
    This attack can be carried out without requiring elevated privileges if anonymous access is enabled.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10490:11 advisory.

    grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins     and Open Redirect (CVE-2025-4123)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:8683 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect     (CVE-2025-4123)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
275983	TencentOS Server 4: grafana (TSSA-2025:0371)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
237401	FreeBSD : grafana -- XSS vulnerability (45eb98d6-3b13-11f0-97f7-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	2025/5/28	2025/6/5	high
237366	RHEL 8 : grafana (RHSA-2025:7894)	Nessus	Red Hat Local Security Checks	2025/5/27	2025/6/5	high
251948	Linux Distros Unpatched Vulnerability : CVE-2025-4123	Nessus	Misc.	2025/8/19	2025/8/19	high
276312	TencentOS Server 3: grafana (TSSA-2025:0458)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	medium
305972	Unity Linux 20.1060a / 20.1070a Security Update: grafana (UTSA-2026-007100)	Nessus	Unity Linux Local Security Checks	2026/4/10	2026/4/10	medium
236980	AlmaLinux 8 : grafana (ALSA-2025:7894)	Nessus	Alma Linux Local Security Checks	2025/5/20	2025/5/20	high
237276	Alibaba Cloud Linux 3 : 0074: grafana (ALINUX3-SA-2025:0074)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/27	2025/5/27	high
282866	MiracleLinux 9 : grafana-10.2.6-13.el9_6 (AXSA:2025-10490:11)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	medium
240685	RHEL 8 : grafana (RHSA-2025:8683)	Nessus	Red Hat Local Security Checks	2025/6/26	2025/6/26	high

检测

插件搜索

high

high

high

high

medium

medium

high

high

medium

high