7.3

CVE-2023-0507: grafana Cross-site Scripting

CVSS: 7.3v3.1HighModified
AliasesUBUNTU-CVE-2023-0507GHSA-hjv9-hm2f-rpcjBIT-grafana-2023-0507
Published 01-03-2023Last modified 28-01-2026
Open JSON

Vulnerability summary

CVE-2023-0507 is a high (CVSS 7.3) Cross-site Scripting vulnerability in grafana. EPSS estimates a 15.46% chance of exploitation in the next 30 days, higher than 96.7% of scored vulnerabilities.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.3/10
010
High · v3.1 (CVE.org)
EPSS score
15.46%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 5
SUSE-SU-2023:1902-1SUSE-SU-2023:1903-1SUSE-SU-2023:1904-1SUSE-SU-2024:0191-1SUSE-SU-2024:0196-1

Timeline

  1. 01-03-2023
    PublishedVulnerability first disclosed.
  2. 28-01-2026
    Last modifiedVulnerability information updated.

Description

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

15.46%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 15.46% on 21-09-2026

21-09-202621-10-2026
EPSS score
15.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Grafana2 products
  • grafana≥ 9.0.0, < 9.2.13 | ≥ 8.1.0, < 8.5.21 | ≥ 9.2.0, < 9.2.13 | ≥ 9.3.0, < 9.3.8
  • grafana enterprise≥ 8.1.0, < 8.5.21 | ≥ 9.0.0, < 9.2.13 | ≥ 9.3.0, < 9.3.8
Github.com/grafana1 product
  • grafana≥ 8.1.0, < 8.5.21 | ≥ 9.0.0, < 9.2.13 | ≥ 9.3.0, < 9.3.8
Ubuntu1 product
  • grafanaAll versions (No fix recorded)

3 vendors · 4 products

References

8 links