{
  "threat_severity" : "Moderate",
  "public_date" : "2023-03-22T00:00:00Z",
  "bugzilla" : {
    "description" : "grafana: Stored XSS in Graphite FunctionDescription tooltip",
    "id" : "2181117",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2181117"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-79",
  "details" : [ "Grafana is an open-source platform for monitoring and observability. \nGrafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. \nThe stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized.\nAn attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description. \nUsers may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.", "A flaw was found in Grafana. This flaw allows an attacker to host a Graphite instance with modified Function Descriptions containing XSS payloads. When the victim uses it in a query and accidentally hovers over the Function Description, an attacker-controlled XSS payload will be executed." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Ceph Storage 6.1",
    "release_date" : "2023-12-12T00:00:00Z",
    "advisory" : "RHSA-2023:7741",
    "cpe" : "cpe:/a:redhat:ceph_storage:6.1::el9",
    "package" : "rhceph/rhceph-6-dashboard-rhel9:6-82"
  } ],
  "package_state" : [ {
    "product_name" : "OpenShift Service Mesh 2.1",
    "fix_state" : "Not affected",
    "package_name" : "servicemesh-grafana",
    "cpe" : "cpe:/a:redhat:service_mesh:2.1"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/acm-grafana-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Ceph Storage 3",
    "fix_state" : "Out of support scope",
    "package_name" : "grafana",
    "cpe" : "cpe:/a:redhat:ceph_storage:3"
  }, {
    "product_name" : "Red Hat Ceph Storage 4",
    "fix_state" : "Affected",
    "package_name" : "rhceph/rhceph-4-dashboard-rhel8",
    "cpe" : "cpe:/a:redhat:ceph_storage:4"
  }, {
    "product_name" : "Red Hat Ceph Storage 5",
    "fix_state" : "Affected",
    "package_name" : "rhceph/rhceph-5-dashboard-rhel8",
    "cpe" : "cpe:/a:redhat:ceph_storage:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "grafana",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Will not fix",
    "package_name" : "grafana",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-grafana",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Not affected",
    "package_name" : "grafana",
    "cpe" : "cpe:/a:redhat:storage:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-1410\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-1410\nhttps://github.com/grafana/bugbounty/security/advisories/GHSA-qrrg-gw7w-vp76\nhttps://grafana.com/blog/2023/03/22/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-1410/" ],
  "name" : "CVE-2023-1410",
  "csaw" : false
}