Most recent entries from all

bdu:2023-01776

BIT-grafana-2023-0594

Affected: Bitnami: grafana

Grafana is an open-source platform for monitoring and observability.

Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization.

The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded.

An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript.

This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.

Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

EUVD-2026-266783

fkie_cve-2023-0594

Grafana is an open-source platform for monitoring and observability.

Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization.

The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded.

An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript.

Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

GHSA-xw5p-hw8j-xg4q — Grafana vulnerable to Cross-site Scripting

Affected: Go: github.com/grafana/grafana

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

gsd-2023-0594

RHSA-2024:0746 — Red Hat Security Advisory: new container image: rhceph-5.3

grafana: Use of Cache Containing Sensitive Information golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests haproxy: segfault DoS grafana: cross site scripting grafana: cross site scripting grafana: JWT token leak to data source grafana: stored XSS vulnerability affecting the core plugin "Text" golang: html/template: backticks not treated as string delimiters haproxy: request smuggling attack in HTTP/1 header parsing

SUSE-SU-2023:1902-1 — Security update for SUSE Manager Client Tools

Security update for SUSE Manager Client Tools

UBUNTU-CVE-2023-0594

Affected: Ubuntu:16.04:LTS: grafana

WID-SEC-W-2023-0528 — Grafana: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.