Stored cross-site scripting in Grafana - CVE-2023-22462
Published: March 1, 2023 / Updated: March 22, 2023
Vulnerability identifier: #VU72675
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2023-22462
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Text plugin. A remote user with Editor role can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Affected software
Grafana
Red Hat Ceph Storage
Red Hat Enterprise Linux for x86_64
ObjectScale
Storage Ceph
Red Hat Ceph Storage
Red Hat Enterprise Linux for x86_64
ObjectScale
Storage Ceph
How to mitigate CVE-2023-22462
Install update from vendor's website.
Grafana - addressed in versions 9.2.10, 9.3.4
ObjectScale - update to 1.4.0
Storage Ceph - update to 6.1
ObjectScale - update to 1.4.0
Storage Ceph - update to 6.1