CVE-2024-6837

mediumpriority · track · 0DERU

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

CVSS 5.4 · medium

Is it mine?

38 products

Check your exposure

Who says so?

3 sources

cnnvd · fstec_bdu · cert_bund

РусскийShown in its original language — a full translation is planned for a future version.

Уязвимость интерфейса платформы для мониторинга и наблюдения Grafana связана с непринятием мер по защите структуры веб-страницы при обработке конечной точки /swagger. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, проводить межсайтовые сценарные атаки (XSS)

cvss

Technical severity, 0–10. One row per scoring source.

5.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.4mediumAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79US

affected products (38)

Products and version ranges known to be affected.

Open Source Grafana Loki <10.4.7all versionscert_bundDE
Open Source Grafana Loki <11.0.3all versionscert_bundDE
Open Source Grafana Loki <11.1.4all versionscert_bundDE
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE Managerall versionscert_bundDEcpe:/a:suse:manager:-
SUSE Manager Client Tools for SLE 12all versionscert_bundDEcpe:/a:suse:manager:client_tools_for_sle_12
Grafana Loki< 10.4.7cert_bundDE
Grafana Loki< 11.0.3cert_bundDE
Grafana Loki< 11.1.4cert_bundDE
Grafana Labs Grafana10.4.0 → 10.4.7fstec_bduRU
Grafana Labs Grafana11.0.0 → 11.0.3fstec_bduRU
Grafana Labs Grafana11.1.0 → 11.1.4fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.6fstec_bduRU
Novell Inc. SUSE Linux Enterprise High Performance Computing≤ 15 SP5-ESPOSfstec_bduRU
Novell Inc. SUSE Linux Enterprise High Performance Computing≤ 15 SP5-LTSSfstec_bduRU
Novell Inc. SUSE Linux Enterprise High Performance Computing≤ 15 SP6fstec_bduRU
Novell Inc. SUSE Linux Enterprise High Performance Computing≤ 15 SP4-LTSSfstec_bduRU
Novell Inc. SUSE Linux Enterprise High Performance Computing≤ 15 SP3-LTSSfstec_bduRU
Novell Inc. SUSE Linux Enterprise High Performance Computing≤ 15 SP4-ESPOSfstec_bduRU
Novell Inc. SUSE Linux Enterprise Module for Basesystem≤ 15 SP6fstec_bduRU

showing 20 of 38

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1857Grafana Loki: Schwachstelle ermöglicht Cross-Site ScriptingDeutsch2024-08-14csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Grafana Loki ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2025-02-25modified 2026-08-24

references (2) cnnvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan