Описание
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
A flaw was found in the Grafana geomap panel's XYZ tile layer. An attacker with editor privileges can exploit a sanitize-then-interpolate ordering bug by setting a textbox variable's default value to a Cross-Site Scripting (XSS) payload. This payload executes for every user who opens the dashboard, potentially leading to arbitrary code execution and information disclosure.
Отчет
An authenticated attacker with Editor privileges can inject an XSS payload into Grafana's geomap panel to compromise dashboard viewers. Red Hat products do not ship the affected version and are not impacted.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | grafana-infinity-datasource-npm | Not affected | ||
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/3scale-operator-bundle | Not affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-grafana-rhel9 | Not affected | ||
| Red Hat Ceph Storage 4 | rhceph/grafana-rhel9 | Not affected | ||
| Red Hat Ceph Storage 5 | rhceph/rhceph-5-dashboard-rhel8 | Not affected | ||
| Red Hat Ceph Storage 6 | rhceph/rhceph-6-dashboard-rhel9 | Not affected | ||
| Red Hat Ceph Storage 7 | rhceph/grafana-rhel9 | Not affected | ||
| Red Hat Ceph Storage 8 | rhceph/grafana-rhel9 | Not affected | ||
| Red Hat Ceph Storage 9 | rhceph/grafana-rhel10 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
A user with Editor permissions can place a malicious script in the att ...
Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug
EPSS
7.3 High
CVSS3