vulnerability
FreeBSD: VID-e2a8e2bd-b808-11ed-b695-6c3be5272acd (CVE-2023-0507): Grafana -- Stored XSS in geomap panel plugin via attribution
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:M/Au:S/C:C/I:C/A:N) | Mar 1, 2023 | Mar 4, 2023 | Mar 25, 2026 |
Severity
8
CVSS
(AV:N/AC:M/Au:S/C:C/I:C/A:N)
Published
Mar 1, 2023
Added
Mar 4, 2023
Modified
Mar 25, 2026
Description
Grafana Labs reports: During an internal audit of Grafana on January 25, a member of the security team found a stored XSS vulnerability affecting the core geomap plugin. The stored XSS vulnerability was possible because map attributions weren’t properly sanitized, allowing arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. The CVSS score for this vulnerability is 7.3 High (CVSS:7.3/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).
Solutions
freebsd-upgrade-package-grafanafreebsd-upgrade-package-grafana8freebsd-upgrade-package-grafana9
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.