Lucene search
Veracode Vulnerability DatabaseVERACODE:39495HistoryMar 03, 2023 - 2:02 a.m.
Cross-site Scripting (XSS)
2023-03-0302:02:43
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
12
grafana
xss
vulnerability
admin
inject
javascript
change
password
0.001 Low
EPSS
Percentile
21.0%
github.com/grafana/grafana is vulnerable to Cross-site Scripting (XSS). The vulnerability exists because the value of a span’s attributes/resources is not properly sanitized, which allows an attacker with an admin role to inject and execute malicious JavaScript and change a password for a user when they have the editor role
References
github.com/advisories/GHSA-xw5p-hw8j-xg4q
github.com/grafana/grafana/commit/6df113e412d8acb6426deedbb3a8012118b2c543
github.com/grafana/grafana/commit/cb402af51412dc262b3f74152332a1dbee2c7263
github.com/grafana/grafana/commit/f89553932a4b534ef3b6942e02c11e19eee10a18
github.com/grafana/grafana/issues/745
github.com/grafana/grafana/issues/753
grafana.com/security/security-advisories/cve-2023-0594/
Related
osv
osv
Grafana vulnerable to Cross-site Scripting
2023-03-01 18:30:59
BIT-grafana-2023-0594
2024-03-06 10:54:07
CVE-2023-0594
2023-03-01 16:15:09
redhatcve
redhatcve
CVE-2023-0594
2023-03-01 18:30:18
alpinelinux
alpinelinux
CVE-2023-0594
2023-03-01 16:15:00
github
github
Grafana vulnerable to Cross-site Scripting
2023-03-01 18:30:59
cve
cve
CVE-2023-0594
2023-03-01 16:15:09
nvd
nvd
CVE-2023-0594
2023-03-01 16:15:09
ibm
ibm
cvelist
cvelist
CVE-2023-0594
2023-03-01 15:36:43
prion
prion
Cross site scripting
2023-03-01 16:15:00
cgr
cgr
CVE-2023-0594 vulnerabilities
2024-05-19 03:07:16
ubuntucve
ubuntucve
CVE-2023-0594
2023-03-01 00:00:00
redos
redos
ROS-20240403-14
2024-04-03 00:00:00
ROS-20240404-01
2024-04-04 00:00:00
openvas
openvas
Grafana < 8.5.21, 9.2.x < 9.2.13, 9.3.x < 9.3.8 Multiple Vulnerabilities
2023-03-02 00:00:00
freebsd
freebsd
Grafana -- Stored XSS in geomap panel plugin via attribution
2023-01-25 00:00:00
Grafana -- Stored XSS in TraceView panel
2023-01-30 00:00:00
Grafana -- Stored XSS in text panel plugin
2023-01-01 00:00:00
nessus
nessus
redhat
redhat
(RHSA-2024:0746) Important: new container image: rhceph-5.3
2024-02-08 16:24:16