PRIOn knowledge basePRION:CVE-2023-1410

HistoryMar 23, 2023 - 8:15 a.m.

Cross site scripting

2023-03-2308:15:00

PRIOn knowledge base

www.prio-n.com

grafana

xss vulnerability

graphite

functiondescription

data source

admin

upgrade

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.7%

JSON

Grafana is an open-source platform for monitoring and observability.

Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip.

The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized.

An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description.

Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.

CPENameOperatorVersion
grafanagt9.3.0
grafanalt9.3.11
grafanage9.2.0
grafanalt9.2.15
grafanage8.0.0
grafanalt8.5.22

Name	Operator	Version
grafana	gt	9.3.0
grafana	lt	9.3.11
grafana	ge	9.2.0
grafana	lt	9.2.15
grafana	ge	8.0.0
grafana	lt	8.5.22

References

github.com/grafana/bugbounty/security/advisories/GHSA-qrrg-gw7w-vp76

grafana.com/security/security-advisories/cve-2023-1410/

security.netapp.com/advisory/ntap-20230420-0003/