漏洞描述
Grafana是Grafana开源的一套提供可视化监控界面的开源监控工具。该工具主要用于监控和分析Graphite、InfluxDB和Prometheus等。 Grafana 8.1版本存在跨站脚本漏洞，该漏洞源于地图属性未正确清理。攻击者利用该漏洞在Grafana实例当前授权用户环境中执行任意JavaScript。
Grafana Geomap 存在XSS漏洞
PoC代码
暂无相关漏洞推荐
- Grafana存在重定向漏洞(CVE-2025-4123)
- Grafana /avatar 服务器端请求伪造漏洞（CVE-2020-13379）
- POC CVE-2019-15043: Grafana - Improper Access Control
- POC CVE-2020-11110: Grafana <= 6.7.1 - Cross-Site Scripting
- POC CVE-2020-13379: Grafana 3.0.1-7.0.1 - Server-Side Request Forgery
- POC CVE-2021-27358: Grafana Unauthenticated Snapshot Creation
- POC CVE-2021-39226: Grafana Snapshot - Authentication Bypass
- POC CVE-2021-41174: Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting
- POC CVE-2021-43798: Grafana v8.x - Arbitrary File Read
- POC CVE-2022-26148: Grafana & Zabbix Integration - Credentials Disclosure
- POC CVE-2024-9264: Grafana Post-Auth DuckDB - SQL Injection To File Read
- POC CVE-2025-3415: Grafana - Exposes DingDing API Keys
- POC CVE-2025-4123: Grafana - XSS / Open Redirect / SSRF via Client Path Traversal