Lucene search

GRAFANACVE-2023-3010

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-3010

2023-10-2518:17:29

CWE-79

GRAFANA

web.nvd.nist.gov

148

grafana

worldmap

panel

plugin

1.0.4

dom

xss

vulnerability

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

20.2%

JSON

Grafana is an open-source platform for monitoring and observability.

The WorldMap panel plugin, versions before 1.0.4 contains a DOM XSS vulnerability.

Affected configurations

Nvd

Node

grafanaworldmap_panelRange<1.0.4grafana

VendorProductVersionCPE
grafanaworldmap_panel*cpe:2.3:a:grafana:worldmap_panel:*:*:*:*:*:grafana:*:*

Vendor	Product	Version	CPE
grafana	worldmap_panel	*	cpe:2.3:a:grafana:worldmap_panel::::::grafana::*

CNA Affected

[
  {
    "product": "worldmap-panel",
    "vendor": "Grafana",
    "versions": [
      {
        "lessThan": "1.0.4",
        "status": "affected",
        "version": "0.3.30",
        "versionType": "semver"
      }
    ]
  }
]

References

grafana.com/security/security-advisories/cve-2023-3010/

security.netapp.com/advisory/ntap-20240503-0001/

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

20.2%

JSON

Related for CVE-2023-3010