p PatchFirst

CVE-2020-11110

CVE-2020-11110

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

CVSS 5.4 · Medium · EPSS 9.6% · Public exploit

Published
Updated

Stack: system · applications

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • grafana Ubuntu:16.04:LTS

    Versions
    • 2.6.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →