Description

A flaw was found in Grafana. A user with an Editor role can exploit a stored cross-site scripting (XSS) vulnerability in the Geomap panel. This occurs because the Geomap panel loads map styles from a URL and inserts the style's attribution field into the page without proper sanitization. By controlling the map style, an attacker can execute arbitrary JavaScript in the browser of anyone viewing the dashboard. If an Organization Administrator views the dashboard, the attacker's script can elevate their own account to Organization Administrator, leading to privilege escalation and unauthorized access to organizational dashboards, data source configurations, and credentials.

Mitigation

Aliases