Cross-site Scripting (XSS) Affecting grafana package, versions *


Severity

Recommended
medium

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.07% (33rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Scripting (XSS) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL9-GRAFANA-3337102
  • published2 Mar 2023
  • disclosed1 Mar 2023

Introduced: 1 Mar 2023

CVE-2023-0507  (opens in a new tab)
CWE-80  (opens in a new tab)

How to fix?

There is no fixed version for RHEL:9 grafana.

NVD Description

Note: Versions mentioned in the description apply only to the upstream grafana package and not the grafana package as distributed by RHEL. See How to fix? for RHEL:9 relevant fixed versions and status.

Grafana is an open-source platform for monitoring and observability.

Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap.

The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.

An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript.

This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.

Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

CVSS Scores

version 3.1