CVE-2023-1410
published 2023-03-23CVE-2023-1410: Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The…
PriorityP421medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.95%
56.9th percentile
Grafana is an open-source platform for monitoring and observability.
Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip.
The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized.
An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description.
Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | grafana_grafana | >= 8.0.0 < 8.5.22 | 8.5.22 |
| github.com | grafana_grafana | >= 9.0.0 < 9.2.15 | 9.2.15 |
| github.com | grafana_grafana | >= 9.3.0 < 9.3.11 | 9.3.11 |
| github.com | grafana_grafana | >= 9.4.0 < 9.4.7 | 9.4.7 |
| grafana | grafana | < 9.3.11 | 9.3.11 |
| grafana | grafana | >= 8.0.0 < 8.5.22 | 8.5.22 |
| grafana | grafana | >= 9.0.0 < 9.2.15 | 9.2.15 |
| grafana | grafana | >= 9.2.0 < 9.2.15 | 9.2.15 |
| grafana | grafana | >= 9.3.0 < 9.3.11 | 9.3.11 |
| grafana | grafana_enterprise | >= 8.0.0 < 8.5.22 | 8.5.22 |
| grafana | grafana_enterprise | >= 9.0.0 < 9.2.15 | 9.2.15 |
| grafana | grafana_enterprise | >= 9.3.0 < 9.3.11 | 9.3.11 |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
osv4.8MEDIUM
vendor_redhat6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip
osv·2023-03-23
CVE-2023-1410 [MEDIUM] Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip
Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip
### Summary
When a Graphite data source is added, one can use this data source in a dashboard. This contains a feature to use `Functions`. Once a function is selected, a small tooltip will be shown when hovering over the name of the function. This tooltip will allow you to delete the selected Function from your query or show the Function Description. However, no sanitization is done when adding this description to the DOM. Since it is not uncommon to connect to public data sources, and attacker could host a Graphite instance with modified Function Descriptions containing XSS payloads. When the victim uses it in a query and accidentally hovers over the Function Description, an attacker controlled XSS payload will b
GHSA
Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip
ghsa·2023-03-23
CVE-2023-1410 [MEDIUM] CWE-79 Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip
Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip
### Summary
When a Graphite data source is added, one can use this data source in a dashboard. This contains a feature to use `Functions`. Once a function is selected, a small tooltip will be shown when hovering over the name of the function. This tooltip will allow you to delete the selected Function from your query or show the Function Description. However, no sanitization is done when adding this description to the DOM. Since it is not uncommon to connect to public data sources, and attacker could host a Graphite instance with modified Function Descriptions containing XSS payloads. When the victim uses it in a query and accidentally hovers over the Function Description, an attacker controlled XSS payload will b
OSV
CVE-2023-1410: Grafana is an open-source platform for monitoring and observability
osv·2023-03-23·CVSS 4.8
CVE-2023-1410 [MEDIUM] CVE-2023-1410: Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description. Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.
Red Hat
grafana: Stored XSS in Graphite FunctionDescription tooltip
vendor_redhat·2023-03-22·CVSS 6.2
CVE-2023-1410 [MEDIUM] CWE-79 grafana: Stored XSS in Graphite FunctionDescription tooltip
grafana: Stored XSS in Graphite FunctionDescription tooltip
Grafana is an open-source platform for monitoring and observability.
Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip.
The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized.
An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description.
Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.
A flaw was found in Grafana. This flaw allows an attacker to host a Graphite instance with modified Function Descriptions containing XSS payloads
No detection rules found.
No public exploits indexed.
https://github.com/grafana/bugbounty/security/advisories/GHSA-qrrg-gw7w-vp76https://grafana.com/security/security-advisories/cve-2023-1410/https://security.netapp.com/advisory/ntap-20230420-0003/https://github.com/grafana/bugbounty/security/advisories/GHSA-qrrg-gw7w-vp76https://grafana.com/security/security-advisories/cve-2023-1410/https://security.netapp.com/advisory/ntap-20230420-0003/
2023-03-23
Published