BIT-grafana-2020-11110

vendorUSosv

view advisory published 2024-03-06Licence: per source

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-11110US	medium5.4	9.62% (95th)	Exploit	2020-07-27
Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed afte…

references

External citations — patches, advisories, analysis.

https://github.com/grafana/grafana/blob/master/CHANGELOG.mdADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2020-11110WEB
https://security.netapp.com/advisory/ntap-20200810-0002/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan