CVE-2023-1410: Stored XSS in Graphite FunctionDescription tooltip
Grafana is an open-source platform for monitoring and observability.
Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip.
The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized.
An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description.
Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.
Other sources
When a Graphite data source is added, one can use this data source in a dashboard. This contains a feature to use Functions. Once a function is selected, a small tooltip will be shown when hovering over the name of the function. This tooltip will allow you to delete the selected Function from your query or show the Function Description. However, no sanitization is done when adding this description to the DOM.
Since it is not uncommon to connect to public data sources, an attacker could host a Graphite instance with modified Function Descriptions containing XSS payloads. When the victim uses it in a query and accidentally hovers over the Function Description, an attacker-controlled XSS payload will be executed.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-1410?
CVE-2023-1410 is a stored XSS vulnerability in Grafana's Graphite Function Description tooltip.
What is Grafana?
Grafana is an open-source platform for monitoring and observability.
What is the severity rating of CVE-2023-1410?
CVE-2023-1410 has a severity rating of 4.8 (medium).
Which software versions are affected by CVE-2023-1410?
Grafana versions between 8.0.0 and 8.5.22, versions between 9.2.0 and 9.2.15, and versions between 9.3.0 and 9.3.11 are affected by CVE-2023-1410.
How can I fix the CVE-2023-1410 vulnerability in Grafana?
To fix the CVE-2023-1410 vulnerability in Grafana, you should update to a version that is not affected by the vulnerability.