Riskcovery

CVE-2023-1410

Stored XSS in Graphite FunctionDescription tooltip

State
Published
Severity
6.2 Medium
Published
Mar 23, 2023
Updated
Mar 4, 2025
Reserved
Mar 15, 2023

Read the record on cve.org

Description

Grafana is an open-source platform for monitoring and observability.

Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip.

The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized.

An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description.

Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.

Scores

CVSSScoreVectorSource
3.16.2 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:NGRAFANA

Weaknesses

Affected Products

ProductVersions
GrafanaGrafana
  • 8.0.0 to before 8.5.22Affected
  • 9.0.0 to before 9.2.15Affected
  • 9.3.0 to before 9.3.11Affected
Grafana EnterpriseGrafana
  • 8.0.0 to before 8.5.22Affected
  • 9.0.0 to before 9.2.15Affected
  • 9.3.0 to before 9.3.11Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.