PT-2023-1982 · Grafana+2 · Grafana+2

Published

2023-02-28

·

Updated

2024-04-03

·

CVE-2023-0507

CVSS v2.0

8.5

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions Grafana versions 8.1 through 8.5.20 Grafana versions 9.0 through 9.2.12 Grafana versions 9.3 through 9.3.7
Description The stored XSS vulnerability in the core plugin GeoMap of Grafana is possible due to map attributions not being properly sanitized, allowing arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role to change a panel to include a map attribution containing JavaScript, which can lead to vertical privilege escalation. This means a user with the Editor role can change the password of a user with the Admin role if the Admin user executes malicious JavaScript while viewing a dashboard.
Recommendations To resolve the issue, upgrade to version 8.5.21, 9.2.13, or 9.3.8 to receive a fix. As a temporary workaround, consider restricting access to the GeoMap plugin for users with the Editor role until a patch is available. Restrict the ability to change map attributions to only Admin users to minimize the risk of exploitation. Avoid using the GeoMap plugin until the issue is resolved.

Fix

OS Command Injection

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2023-4133
ALT-PU-2023-4148
ALT-PU-2023-4346
ALT-PU-2023-4567
BDU:2023-01605
BIT-GRAFANA-2023-0507
CVE-2023-0507
GHSA-HJV9-HM2F-RPCJ
SUSE-SU-2023:1902-1
SUSE-SU-2023:1903-1
SUSE-SU-2023:1904-1
SUSE-SU-2024:0191-1
SUSE-SU-2024:0196-1

Affected Products

Alt Linux
Grafana
Red Os