Описание
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
Ссылки
- Broken Link
Уязвимые конфигурации
EPSS
7.3 High
CVSS3
5.4 Medium
CVSS3
Дефекты
Связанные уязвимости
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
A user with Editor permissions can place a malicious script in the att ...
Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug
EPSS
7.3 High
CVSS3
5.4 Medium
CVSS3