CVE-2023-0507High· 7.3▾ TwilightGrafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attribut…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 3.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
15%
Grafana is an open-source platform for monitoring and observability.
Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap.
The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.
An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript.
This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.
Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.
grafana >= 8.1.0, < 8.5.21grafana >= 9.2.0, < 9.2.13grafana >= 9.3.0, < 9.3.8Upgrade past the affected range:
grafana 9.3.8Connected by shared product, vendor, weakness, or advisory.
CVE-2022-23552High· 7.3Grafana is an open-source platform for monitoring and observability
CVE-2022-39324Medium· 6.7Grafana is an open-source platform for monitoring and observability
CVE-2026-9029High· 7.3A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable
CVE-2022-23498High· 7.1Grafana is an open-source platform for monitoring and observability
CVE-2022-36062High· 7.6Grafana is an open-source platform for monitoring and observability
CVE-2026-76154High· 7.3A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escal…