Skip to content
OpenAdvisories
Medium WID-SEC-2023-0528 3 CVEs

Grafana: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Feb 28, 2023 · Updated Feb 8, 2024 · Revision 5 · de-DE

Vendor: Grafana Vendor: Hitachi Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Grafana Product: Linux Product: Ops Center Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Grafana ist eine Open-Source Analyse- und Visualisierungssoftware.

Vulnerabilities 3

  • High 7.3
    CVE-2023-0507 EPSS 15%

    Grafana vulnerable to Cross-site Scripting

    Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren't properly sani…

    Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu Go
  • High 7.3
    CVE-2023-0594

    Grafana vulnerable to Cross-site Scripting

    Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources…

    Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu Go
  • Medium 6.4
    CVE-2023-22462

    Stored XSS in Grafana Text plugin

    Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires seve…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go

Revision history

  1. #5

    Neue Updates von Red Hat aufgenommen

  2. #4

    Neue Updates von SUSE aufgenommen

  3. #3

    Neue Updates von HITACHI aufgenommen

  4. #2

    Neue Updates von SUSE aufgenommen

  5. #1

    Initiale Fassung

References