Grafana OSS: Stored XSS via external Alertmanager generatorURL

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL . The attacker is authorized to create the alert, but not to execute script in another user’s Grafana session. Grafana renders...

CVE-2024-57957

creationtimestamp| type| source ---|---|--- 2025-02-06 13:16:59+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhj6bcktzr2e 2025-02-06 16:04:03+00:00| seen| https://t.me/cvedetector/17393 2025-02-06 16:43:51+00:00| seen|...