Skip to main content
CVE-2024-47875VulnerabilityPublished Updated

SUSE · security update for grafana

Affects SUSESource GCVE Database

0
Authoritative record:CVE-2024-47875· Critical 10.0

Not known to be exploited · CVSS 10.0 Critical : upgrade SUSE to 3.1.3 or 2.5.0 as a priority.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 3.1 base score
10.0Critical
How severe the flaw is on the 0–10 CVSS scale.
EPSS
1.1% chance of exploitation in 30 days – higher than 66% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 3.1.3, 2.5.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 11 Oct 2024

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Upgrade dompurify to 3.1.3 or 2.5.0.

Affected software

ProductAffectedFixed in
npmdompurifypkg:npm/dompurifyOther threatsAffected
  • <2.5.0
  • <3.1.3
Fixed in
  • 2.5.0
  • 3.1.3

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released official security advisories and updated container images and packages to fix this vulnerability. Users should follow the upgrade instructions provided in the Red Hat advisories and documentation to update to the fixed versions of Red Hat OpenShift Container Platform (4.13 and 4.16) and Logging subsystem (5.6.27 and 5.8.16). Applying these updates fully mitigates the vulnerability. No additional mitigation steps are indicated beyond applying the official patches and updates.

Description

A high severity cross-site scripting (XSS) vulnerability (CVE-2024-47875) has been identified in the Logging subsystem of Red Hat OpenShift. This issue is caused by a nesting-based mutation flaw in the dompurify library. Red Hat has released security advisories and updated container images and packages to address this vulnerability. Users of Red Hat OpenShift Container Platform versions 4.13 and 4.16, as well as Logging subsystem versions 5.6.27 and 5.8.16, are advised to upgrade to the fixed versions following official guidance.

References

Community reviews

Loading reviews…