CVE-2023-0594

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

• CWE-79
• CWE-79

• https://grafana.com/security/security-advisories/cve-2023-0594/Vendor Advisory
• https://grafana.com/security/security-advisories/cve-2023-0594/Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230331-0007/

Published

Mar 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-0588The Catalyst Connect Zoho CRM Client Portal WordPress plugin…6.1
• CVE-2023-0589The WP Image Carousel WordPress plugin through 1.0.2 does no…5.4
• CVE-2023-0590A use-after-free flaw was found in qdisc_graft in net/sched/…4.7
• CVE-2023-0591 ubireader_extract_files is vulnerable to path traversal whe…5.5
• CVE-2023-0592A path traversal vulnerability affects jefferson's JFFS2 fil…5.5
• CVE-2023-0593A path traversal vulnerability affects yaffshiv YAFFS filesy…5.5
• CVE-2023-0595A CWE-117: Improper Output Neutralization for Logs vulnerabi…5.3
• CVE-2023-0597A flaw possibility of memory leak in the Linux kernel cpu_en…5.5
• CVE-2023-0598 GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1,…9.8
• CVE-2023-0599Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from …4.8
• CVE-2023-0600The WP Visitor Statistics (Real Time Traffic) WordPress plug…9.8
• CVE-2023-0602The Twittee Text Tweet WordPress plugin through 1.0.8 does n…6.1