{"schema_version":"1.9.0","id":"CVE-2023-0594","published":"2023-03-01T15:36:43.881Z","modified":"2026-08-12T03:51:20.050922536Z","aliases":["BIT-grafana-2023-0594","GHSA-xw5p-hw8j-xg4q"],"related":["SUSE-SU-2023:1902-1","SUSE-SU-2023:1903-1","SUSE-SU-2023:1904-1","SUSE-SU-2024:0191-1","SUSE-SU-2024:0196-1"],"details":"Grafana is an open-source platform for monitoring and observability. \n\nStarting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. \n\nThe stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded.\n\nAn attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. \n\nThis means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. \n\nUsers may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix. \n\n","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/grafana/grafana","events":[{"introduced":"aee1438ff2f7a8df8d7f2b825f2af9c9edbaa8ed"},{"fixed":"f5c82deccc9cf60dc00efdd56fe12414b0db1e10"},{"introduced":"c7eea48209eb93819a0ab7593921fffba5b2d339"},{"fixed":"0304ba085a385493fe52867e53d7f000a7e9294e"},{"introduced":"e9cb2a313ecc5a8e3cfeca7d2b7df2878802096e"},{"fixed":"7ab70dbce8bd7cf4ad5273ff859a346eeb65bc76"}],"database_specific":{"cpe":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.0.0"},{"fixed":"8.5.21"},{"introduced":"9.2.0"},{"fixed":"9.2.13"},{"introduced":"9.3.0"},{"fixed":"9.3.8"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0594.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0594.json"},{"type":"ADVISORY","url":"https://grafana.com/security/security-advisories/cve-2023-0594/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0594"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20230331-0007/"}],"database_specific":{"cna_assigner":"GRAFANA","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0594.json","unresolved_ranges":[{"extracted_events":[{"introduced":"7.0.0"},{"fixed":"8.5.21"},{"introduced":"9.0.0"},{"fixed":"9.2.13"},{"introduced":"9.3.0"},{"fixed":"9.3.8"},{"introduced":"7.0.0"},{"fixed":"8.5.21"},{"introduced":"9.0.0"},{"fixed":"9.2.13"},{"introduced":"9.3.0"},{"fixed":"9.3.8"}],"source":"AFFECTED_FIELD"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"}]}