Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:29:56 +0000 CVE-2023-0507 https://cve.radiocsirt.org/vuln/cve-2023-0507 <p><strong>Affected:</strong> Grafana, Grafana Enterprise</p> <p>Grafana is an open-source platform for monitoring and observability.</p> <p>Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap.</p> <p>The stored XSS vulnerability was possible due to map attributions weren&#39;t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.</p> <p>An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript.</p> <p>This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.</p> <p>Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.</p> <p><strong>Affected:</strong> Grafana, Grafana Enterprise</p> <p>Grafana is an open-source platform for monitoring and observability.</p> <p>Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap.</p> <p>The stored XSS vulnerability was possible due to map attributions weren&#39;t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.</p> <p>An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript.</p> <p>This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.</p> <p>Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.</p> https://cve.radiocsirt.org/vuln/cve-2023-0507