The vulnerability of the Grafana monitoring and observation platform lies in the improper handling of input during the creation of web pages. This allows attackers to execute cross-site scripting (XSS) attacks.

Grafana page creation input flaw enables remote cross-site scripting via forged function and hover.

Reporter	Title	Published	Views	Family All 68
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Grafana (CVE-2023-1410)	26 Jan 202421:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Grafana	29 Nov 202305:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Grafana (CVE-2023-1410)	18 Jan 202421:15	–	ibm
FreeBSD	Grafana -- Stored XSS in Graphite FunctionDescription tooltip	14 Mar 202300:00	–	freebsd
AlpineLinux	CVE-2023-1410	23 Mar 202308:15	–	alpinelinux
Circl	CVE-2023-1410	23 Mar 202311:36	–	circl
CNNVD	Grafana 跨站脚本漏洞	23 Mar 202300:00	–	cnnvd
CVE	CVE-2023-1410	23 Mar 202307:48	–	cve
Cvelist	CVE-2023-1410 Stored XSS in Graphite FunctionDescription tooltip	23 Mar 202307:48	–	cvelist
EUVD	EUVD-2023-1084	3 Oct 202520:07	–	euvd

Vulners

Node

grafana_labs grafanaRange8.0.0–8.5.22

grafana_labs grafanaRange9.2.0–9.2.15

grafana_labs grafanaRange9.3.0–9.3.11

Source	Link
github	www.github.com/grafana/bugbounty/security/advisories/GHSA-qrrg-gw7w-vp76
grafana	www.grafana.com/security/security-advisories/cve-2023-1410/
redos	www.redos.red-soft.ru/support/secure/
web	www.web.nvd.nist.gov/view/vuln/detail

04 Apr 2024 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 24.7

CVSS 34.8

EPSS0.00954