https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 14:30:49 +0000 https://cve.radiocsirt.org/vuln/cve-2023-22462 <p><strong>Affected:</strong> grafana</p> <p>Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin &#34;Text&#34;. The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to React&#39;s render cycle that will pass though the unsanitized HTML code, but in the next cycle the HTML is cleaned up and saved in Grafana&#39;s database. An attacker needs to have the Editor role in order to change a Text panel to include JavaScript. Another user needs to edit the same Text panel, and click on &#34;Markdown&#34; or &#34;HTML&#34; for the code to be executed. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. This issue has been patched in versions 9.2.10 and 9.3.4.</p> <p><strong>Affected:</strong> grafana</p> <p>Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin &#34;Text&#34;. The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to React&#39;s render cycle that will pass though the unsanitized HTML code, but in the next cycle the HTML is cleaned up and saved in Grafana&#39;s database. An attacker needs to have the Editor role in order to change a Text panel to include JavaScript. Another user needs to edit the same Text panel, and click on &#34;Markdown&#34; or &#34;HTML&#34; for the code to be executed. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. This issue has been patched in versions 9.2.10 and 9.3.4.</p> https://cve.radiocsirt.org/vuln/cve-2023-22462