CVE-2021-41174 – XSS vulnerability allowing arbitrary JavaScript execution

https://notcve.org/view.php?id=CVE-2021-41174

03 Nov 2021 — Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for Ang... • https://github.com/grafana/grafana/commit/31b78d51c693d828720a5b285107a50e6024c912 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •