Skip to content
Fencer Vulns
medium 6.9

CVE-2021-41174 json

XSS vulnerability allowing arbitrary JavaScript execution

published 2021-11-03 5 y ago modified 2026-09-08 2 mo ago also BIT-grafana-2021-41174 , EUVD-2021-2285 , GHSA-3j9m-hcv9-rpj8

cvss
6.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
85.4%
EPSS 85.4% chance of exploitation in 30 days, percentile 99.7%
public exploits
0
none known, plus a Nuclei check

Summary

Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated and the AngularJS rendering engine will execute the JavaScript expression contained in the URL. Users are advised to upgrade as soon as possible. If for some reason you cannot upgrade, you can use a reverse proxy or similar to block access to block the literal string {{ in the path.

Patch / fix

  • npm @grafana/data 8.2.3
  • bitnami grafana 8.2.3
  • grafana grafana 8.2.3
  • rhnlib Manager Client Tools 15-BETA 5.0.1-159000.6.30.1
  • ansible Manager Client Tools 15-BETA 2.9.27-159000.3.9.1
  • grafana Manager Client Tools 15-BETA 9.5.8-159000.4.24.1
  • mgr-push Manager Client Tools 15-BETA 5.0.1-159000.4.21.1
  • spacecmd Manager Client Tools 15-BETA 5.0.1-159000.6.42.1
  • python-hwdata Manager Client Tools 15-BETA 2.3.5-159000.5.13.1
  • python-pyvmomi Manager Client Tools 15-BETA 6.7.3-159000.3.6.1
  • dracut-saltboot Manager Client Tools Beta for SLE Micro 5, Manager Client Tools 15-BETA 0.1.1681904360.84ef141-159000.3.30.1

suse advisories SUSE-SU-2024:0196-1SUSE-SU-2024:0191-1SUSE-SU-2022:4439-1SUSE-SU-2022:4437-1SUSE-SU-2022:4428-1SUSE-SU-2022:3676-1

  • grafana openSUSE Tumbleweed 8.3.4-1.1

opensuse advisories openSUSE-SU-2024:11816-1

  • grafana Arch Linux 8.2.3-1

arch linux advisories AVG-2517

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-41174 updated cvss 6.1

grafana: XSS vulnerability on unauthenticated pages through interpolation binding expressions for AngularJS in URL

  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana
    affected: no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 grafana
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 2 grafana Red Hat Ceph Storage 3 grafana, grafana-container
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-grafana-prometheus Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat OpenShift Container Platform 3.11 openshift3/grafana
    +2 more products
    Red Hat OpenShift Container Platform 4 openshift4/ose-grafana Red Hat Storage 3 grafana
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

85.40% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting nuclei detection template

CVSS scores

assigned by version score vector
CNA 3.1 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
GitHub 3.1 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
OSV 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm @grafana/data
>=8.0.0, <8.2.3
8.2.3
bitnami grafana
>=8.0.0, <8.2.3
8.2.3

Affected products

  • grafana grafana

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.