Executive Summary

This vulnerability exists in the geomap panel's XYZ tile layer due to an ordering bug in how text sanitization and interpolation are handled. Specifically, the function sanitizeTextPanelContent() is applied to the raw template string before the variable substitution occurs via getTemplateSrv().replace(). Because the substitution uses a glob format without HTML escaping, malicious code can be injected. This code is then passed to OpenLayers through element.innerHTML, allowing an Editor to set a textbox variable's default value to an XSS payload. This payload executes for every user who opens the dashboard, effectively bypassing a previous fix (CVE-2023-0507).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a Cross-Site Scripting (XSS) attack, where an attacker can execute malicious scripts in the context of the affected application. Since the payload executes for every user who opens the dashboard, it can compromise user data, steal session tokens, or perform unauthorized actions on behalf of users. The CVSS score of 7.3 indicates a high severity with potential for significant confidentiality and integrity impact, although availability is not affected.

Useful 0 Not Useful 0