FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Grafana -- Stored XSS in geomap panel plugin via attribution

Affected packages
grafana < 8.5.21
9.0.0 <= grafana < 9.2.13
9.3.0 <= grafana < 9.3.8
grafana8 < 8.5.21
9.0.0 <= grafana9 < 9.2.13
9.3.0 <= grafana9 < 9.3.8


VuXML ID e2a8e2bd-b808-11ed-b695-6c3be5272acd
Discovery 2023-01-25
Entry 2023-03-01

Grafana Labs reports:

During an internal audit of Grafana on January 25, a member of the security team found a stored XSS vulnerability affecting the core geomap plugin.

The stored XSS vulnerability was possible because map attributions weren’t properly sanitized, allowing arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.

The CVSS score for this vulnerability is 7.3 High (CVSS:7.3/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).


CVE Name CVE-2023-0507