CVE-2023-1410

MEDIUM

Stored XSS in Graphite FunctionDescription tooltip

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-1410 has a selected CVSS score of 6.2 (medium).

Description

Grafana is an open-source platform for monitoring and observability.  Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description.  Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 4, 2025 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Grafana

Browse Grafana / Grafana

Default status: unaffected

CVE List8.0.0 to < 8.5.22affected
9.0.0 to < 9.2.15affected
9.3.0 to < 9.3.11affected

Grafana Enterprise

Browse Grafana / Grafana Enterprise

Default status: unaffected

CVE List8.0.0 to < 8.5.22affected
9.0.0 to < 9.2.15affected
9.3.0 to < 9.3.11affected

github.com/grafana/grafana

Browse Go / github.com/grafana/grafana
GitHub Advisory8.0.0 to < 8.5.22 · Fixed in 8.5.22affected
9.3.0 to < 9.3.11 · Fixed in 9.3.11affected
9.4.0 to < 9.4.7 · Fixed in 9.4.7affected
9.0.0 to < 9.2.15 · Fixed in 9.2.15affected

References

9