CVE-2023-22462

Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to React's render cycle that will pass though the unsanitized HTML code, but in the next cycle the HTML is cleaned up and saved in Grafana's database. An attacker needs to have the Editor role in order to change a Text panel to include JavaScript. Another user needs to edit the same Text panel, and click on "Markdown" or "HTML" for the code to be executed. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. This issue has been patched in versions 9.2.10 and 9.3.4.

• CWE-79
• CWE-79

• https://github.com/grafana/grafana/commit/db83d5f398caffe35c5846cfa7727d1a2a414165Patch
• https://github.com/grafana/grafana/security/advisories/GHSA-7rqg-hjwc-6mjfVendor Advisory
• https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230413-0004/Third Party Advisory
• https://github.com/grafana/grafana/commit/db83d5f398caffe35c5846cfa7727d1a2a414165Patch
• https://github.com/grafana/grafana/security/advisories/GHSA-7rqg-hjwc-6mjfVendor Advisory
• https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230413-0004/Third Party Advisory

Published

Mar 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22456ViewVC, a browser interface for CVS and Subversion version c…6.1
• CVE-2023-22457CKEditor Integration UI adds support for editing wiki pages …8.8
• CVE-2023-22458Redis is an in-memory database that persists on disk. Authen…5.5
• CVE-2023-2246A vulnerability has been found in SourceCodester Online Pizz…9.8
• CVE-2023-22460go-ipld-prime is an implementation of the InterPlanetary Lin…7.5
• CVE-2023-22461The `sanitize-svg` package, a small SVG sanitizer to prevent…6.1
• CVE-2023-22463KubePi is a k8s panel. The jwt authentication function of Ku…9.8
• CVE-2023-22464ViewVC is a browser interface for CVS and Subversion version…5.4
• CVE-2023-22465Http4s is a Scala interface for HTTP services. Starting with…5.3
• CVE-2023-22466Tokio is a runtime for writing applications with Rust. Start…5.4
• CVE-2023-22467Luxon is a library for working with dates and times in JavaS…7.5
• CVE-2023-22468Discourse is an open source platform for community discussio…5.4