GO-2024-2515

vendorUSosv

Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana

view advisory published 2024-06-28Licence: per source

Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/grafana/grafana before v7.0.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-13430US	medium6.1	1.87% (79th)	—	2020-05-24
Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-7m2x-qhrq-rp8hADVISORY
https://github.com/grafana/grafana/pull/24539FIX
https://github.com/grafana/grafana/releases/tag/v7.0.0WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-13430ADVISORY
https://security.netapp.com/advisory/ntap-20200528-0003WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan