FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Grafana -- Stored XSS in geomap panel plugin via attribution

Affected packages
		grafana	<	8.5.21
9.0.0	<=	grafana	<	9.2.13
9.3.0	<=	grafana	<	9.3.8
		grafana8	<	8.5.21
9.0.0	<=	grafana9	<	9.2.13
9.3.0	<=	grafana9	<	9.3.8

Details

VuXML ID	e2a8e2bd-b808-11ed-b695-6c3be5272acd
Discovery	2023-01-25
Entry	2023-03-01

Grafana Labs reports:

During an internal audit of Grafana on January 25, a member of the security team found a stored XSS vulnerability affecting the core geomap plugin.

The stored XSS vulnerability was possible because map attributions weren’t properly sanitized, allowing arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.

The CVSS score for this vulnerability is 7.3 High (CVSS:7.3/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).

[source]

References

CVE Name	CVE-2023-0507
URL	https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/