{"id":"CVE-2021-23648","aliases":["ALSA-2022:7519","ALSA-2022:8057","DEBIAN-CVE-2021-23648","EUVD-2022-1445","GHSA-hqq7-2q2v-82xq","RHSA-2022:7519","RHSA-2022:8057","RLSA-2022:7519","RLSA-2022:8057","SNYK-JS-BRAINTREESANITIZEURL-2339882","UBUNTU-CVE-2021-23648"],"status":"published","title":"Cross-site Scripting (XSS)","description":"The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0143,"percentile":0.7339,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-03-16T15:45:19Z","modified":"2026-10-29T11:31:18Z","fixes":[{"ecosystem":"npm","package":"@braintree/sanitize-url","fixed_in":["6.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-mermaid","fixed_in":["8.14.0+~cs11.4.14-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@braintree/sanitize-url","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.15-3.el8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.15-3.el9"}]}],"bundled":15},{"source":"osv","ecosystem":"Debian:14","package":"node-mermaid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.0+~cs11.4.14-1"}]}],"versions":["8.11.0+ds+~cs29.13.22-1","8.13.2+ds+~cs30.13.21-1","8.13.2+ds+~cs30.13.21-1.1","8.13.3+ds+~cs26.13.21-1","8.13.3+ds+~cs26.13.21-2","8.13.8+~cs10.4.16-1","8.7.0+ds+~cs27.17.17-1","8.7.0+ds+~cs27.17.17-2","8.7.0+ds+~cs27.17.17-2~bpo10+1","8.7.0+ds+~cs27.17.17-3","8.9.1+ds+~cs26.20.25-1","8.9.3+ds+~cs29.13.19-1"]},{"source":"osv","ecosystem":"npm","package":"@braintree/sanitize-url","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.15-3.el8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.15-3.el8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.15-3.el9"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.15-3.el9"}]}],"bundled":15},{"source":"osv","ecosystem":"Rocky Linux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.15-3.el8"}]}],"bundled":15},{"source":"osv","ecosystem":"Rocky Linux:9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.15-3.el9"}]}],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-mermaid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.7.0+ds+~cs27.17.17-3","8.13.3+ds+~cs26.13.21-1","8.13.3+ds+~cs26.13.21-2","8.13.8+~cs10.4.16-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-mermaid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.2+~2.0.0-1","9.2.2+~2.0.0-2"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"paypal","product":"braintree\\/sanitize-url"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","article"]},{"url":"https://github.com/braintree/sanitize-url/blob/main/src/index.ts%23L11","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"https://github.com/braintree/sanitize-url/pull/40","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","article","report"]},{"url":"https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23648","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/"},{"url":"https://github.com/advisories/GHSA-hqq7-2q2v-82xq"},{"url":"https://access.redhat.com/errata/RHSA-2022:7519","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23648","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1705","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1962","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21673","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21698","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21702","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21703","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21713","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28131","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30630","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30631","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30632","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30633","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30635","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32148","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044628","tags":["report"]},{"url":"https://bugzilla.redhat.com/2045880","tags":["report"]},{"url":"https://bugzilla.redhat.com/2050648","tags":["report"]},{"url":"https://bugzilla.redhat.com/2050742","tags":["report"]},{"url":"https://bugzilla.redhat.com/2050743","tags":["report"]},{"url":"https://bugzilla.redhat.com/2065290","tags":["report"]},{"url":"https://bugzilla.redhat.com/2107342","tags":["report"]},{"url":"https://bugzilla.redhat.com/2107371","tags":["report"]},{"url":"https://bugzilla.redhat.com/2107374","tags":["report"]},{"url":"https://bugzilla.redhat.com/2107376","tags":["report"]},{"url":"https://bugzilla.redhat.com/2107383","tags":["report"]},{"url":"https://bugzilla.redhat.com/2107386","tags":["report"]},{"url":"https://bugzilla.redhat.com/2107388","tags":["report"]},{"url":"https://bugzilla.redhat.com/2107390","tags":["report"]},{"url":"https://bugzilla.redhat.com/2107392","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-7519.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8057","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-8057.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23648","tags":["advisory"]},{"url":"https://github.com/braintree/sanitize-url","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2045880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050742","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050743","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107392","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7519.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23648","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1705","tags":["advisory"]},{"url":"https://go.dev/issue/53188","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1962","tags":["advisory"]},{"url":"https://go.dev/issue/53616","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21673","tags":["advisory"]},{"url":"https://grafana.com/blog/2022/01/18/grafana-8.3.4-and-7.5.13-released-with-important-security-fix/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21698","tags":["advisory"]},{"url":"https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21702","tags":["advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-xc3p-28hw-q24g","tags":["article"]},{"url":"https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21703","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21703","tags":["advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-cmf4-h3xc-jw8w","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21713","tags":["advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-63g3-9jq3-mccv","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28131","tags":["advisory"]},{"url":"https://go.dev/issue/53614","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30630","tags":["advisory"]},{"url":"https://go.dev/issue/53415","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30631","tags":["advisory"]},{"url":"https://go.dev/issue/53168","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30632","tags":["advisory"]},{"url":"https://go.dev/issue/53416","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30633","tags":["advisory"]},{"url":"https://go.dev/issue/53611","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30635","tags":["advisory"]},{"url":"https://go.dev/issue/53615","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32148","tags":["advisory"]},{"url":"https://go.dev/issue/53423","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104367","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8057.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:7519","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8057","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-23648","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-23648","title":"Cross-site Scripting (XSS)","description":"The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.","status":"published","published":"2022-03-16T15:45:19.074Z","modified":"2024-09-16T16:22:58.288Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.488332Z"}],"euvd":[{"id":"EUVD-2022-1445","description":"The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.","status":"published","published":"2022-03-16T15:45:19Z","modified":"2024-09-16T16:22:58Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P","level":"medium"}],"updated_at":"2026-11-03T00:55:52.084115Z"}],"ghsa":[{"id":"GHSA-hqq7-2q2v-82xq","title":"Cross-site Scripting in sanitize-url","description":"The package `@braintree/sanitize-url` before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the `sanitizeUrl` function.","status":"published","published":"2022-03-17T00:00:24Z","modified":"2023-01-27T05:00:43Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:15.574072Z"}],"nvd":[{"id":"CVE-2021-23648","description":"The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.","status":"published","published":"2022-03-16T16:15:10.69Z","modified":"2026-06-17T03:38:51.083Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:05.581807Z"}],"osv":[{"id":"CVE-2021-23648","description":"The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.","status":"published","published":"2022-03-16T16:15:10.69Z","modified":"2026-10-20T10:54:32.751389807Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-23648","description":"The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.","status":"published","published":"2022-03-16T16:15:10.69Z","modified":"2026-10-23T18:04:49.398398473Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-hqq7-2q2v-82xq","title":"Cross-site Scripting in sanitize-url","description":"The package `@braintree/sanitize-url` before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the `sanitizeUrl` function.","status":"published","published":"2022-03-17T00:00:24Z","modified":"2026-09-10T03:49:17.446984712Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"RHSA-2022:7519","title":"Red Hat Security Advisory: grafana security, bug fix, and enhancement update","status":"published","published":"2024-09-30T14:28:37Z","modified":"2026-10-20T10:01:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8057","title":"Red Hat Security Advisory: grafana security, bug fix, and enhancement update","status":"published","published":"2024-09-30T14:26:41Z","modified":"2026-10-20T10:01:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:7519","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nThe following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)\n\nSecurity Fix(es):\n\n* sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)\n\n* golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)\n\n* golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)\n\n* grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)\n\n* prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)\n\n* grafana: XSS vulnerability in data source handling (CVE-2022-21702)\n\n* grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)\n\n* grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)\n\n* golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)\n\n* golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)\n\n* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)\n\n* golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)\n\n* golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)\n\n* golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)\n\n* golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.","status":"published","published":"2022-11-08T06:21:47Z","modified":"2026-02-05T03:00:11.598822Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:8057","title":"Important: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nThe following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055349)\n\nSecurity Fix(es):\n\n* sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)\n\n* golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)\n\n* golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)\n\n* grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)\n\n* prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)\n\n* grafana: XSS vulnerability in data source handling (CVE-2022-21702)\n\n* grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)\n\n* grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)\n\n* golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)\n\n* golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)\n\n* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)\n\n* golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)\n\n* golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)\n\n* golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)\n\n* golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.","status":"published","published":"2022-11-15T06:14:26Z","modified":"2026-02-05T14:45:03.738134Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-23648","description":"The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.","status":"published","published":"2022-03-16T16:15:00Z","modified":"2026-10-17T12:57:11.800873898Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"ALSA-2022:7519","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nThe following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)\n\nSecurity Fix(es):\n\n* sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)\n* golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)\n* golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)\n* grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)\n* prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)\n* grafana: XSS vulnerability in data source handling (CVE-2022-21702)\n* grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)\n* grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)\n* golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)\n* golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)\n* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)\n* golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)\n* golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)\n* golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)\n* golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-08T00:00:00Z","modified":"2026-10-29T11:01:33.126364069Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:8057","title":"Important: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nThe following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055349)\n\nSecurity Fix(es):\n\n* sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)\n* golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)\n* golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)\n* grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)\n* prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)\n* grafana: XSS vulnerability in data source handling (CVE-2022-21702)\n* grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)\n* grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)\n* golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)\n* golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)\n* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)\n* golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)\n* golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)\n* golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)\n* golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2026-10-29T11:31:18.013612121Z","updated_at":"2026-11-02T15:27:51.655726Z"}]}}