CVE-2020-11110: XSS
A flaw was found in grafana. The lack of URL sanitizing allows for stored XSS.
Other sources
Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
Grafana through 6.7.1 allows stored XSS.
Reference: https://github.com/grafana/grafana/blob/master/CHANGELOG.md#672-2020-04-02
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2020-11110.
What is the severity level of CVE-2020-11110?
The severity level of CVE-2020-11110 is medium.
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-79.
What is the impact of this vulnerability?
The impact of this vulnerability is stored Cross-Site Scripting (XSS) attacks.
How can I mitigate this vulnerability?
You can mitigate this vulnerability by updating Grafana to version 6.7.2 or later.