GHSA-x5fh-fvvr-892f

ghsaUSosv

Grafana XSS Vulnerability

view advisory published 2022-05-14Licence: CC-BY-4.0

Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted..

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1000816US	medium5.4	0.74% (55th)	—	2018-12-20
Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code…

references

External citations — patches, advisories, analysis.

https://github.com/grafana/grafanaPACKAGE
https://github.com/grafana/grafana/commit/eabb04cec21dc323347da1aab7fcbf2a6e9dd121WEB
https://github.com/grafana/grafana/issues/13667WEB
https://github.com/grafana/grafana/pull/13670WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1000816ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan