CVE-2023-0594

A flaw was found in the grafana package. This flaw allows a malicious user with the ability to introduce trace data to provide a JavaScript that changes the password for the user viewing the trace view (this could be an admin) to a known password, thus gaining access to the admin account.

This is an issue with Grafana Tempo which we don't ship in Red Hat Enterprise Linux. Hence, RHEL-8, 9 are not-affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applying the Content-Security-Policy shipped with Grafana would block inline scripts from executing and would mitigate this.