Grafana has a Cross-site Scripting issue
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-41117US | medium6.1 | — | ||
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entere… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/grafana/grafanaPACKAGE
- https://github.com/grafana/grafana/commit/4f624a5a01404da45d60063ae1ee2f184818cd42WEB
- https://github.com/grafana/grafana/commit/8dfa6446942873d76cd94c63a2d6b71a25e880daWEB
- https://github.com/grafana/grafana/commit/ecff0d88680cea4ad32709cb3b94b790a7f58d25WEB
- https://grafana.com/security/security-advisories/CVE-2025-41117WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-41117ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan