Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-elasticsearchUpgrade grafana-mysqlUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-postgresUpgrade grafana-opentsdbUpgrade grafana-cloudwatchUpgrade grafana-influxdbUpgrade grafana-azure-monitorUpgrade grafana-stackdriverUpgrade grafana-lokiUpgrade grafana-mssqlUpgrade grafana | May 4, 2022 | Jun 2, 2020 |
| Centos_linux | — | Upgrade grafana-debuginfoUpgrade grafana-cloudwatchUpgrade grafana-prometheusUpgrade grafana-graphiteUpgrade grafana-elasticsearchUpgrade grafana-mssqlUpgrade grafana-opentsdbUpgrade grafana-azure-monitorUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafana-stackdriverUpgrade grafana-lokiUpgrade grafanaUpgrade grafana-mysql | Nov 5, 2020 | Jun 2, 2020 |
| Oracle_linux | — | Upgrade grafana-azure-monitorUpgrade grafana-stackdriverUpgrade grafana-mssqlUpgrade grafana-cloudwatchUpgrade grafana-graphiteUpgrade grafana-elasticsearchUpgrade grafanaUpgrade grafana-mysqlUpgrade grafana-postgresUpgrade grafana-influxdbUpgrade grafana-prometheusUpgrade grafana-opentsdbUpgrade grafana-loki | Nov 12, 2020 | Jun 2, 2020 |
| Redhat_linux | — | Upgrade grafana-azure-monitorUpgrade grafana-lokiUpgrade grafana-prometheusUpgrade grafana-influxdbUpgrade grafana-cloudwatchUpgrade grafana-mssqlUpgrade grafana-mysqlUpgrade grafana-elasticsearchUpgrade grafana-graphiteUpgrade grafanaUpgrade grafana-opentsdbUpgrade grafana-stackdriverUpgrade grafana-debuginfoUpgrade grafana-postgres | Nov 5, 2020 | Jun 2, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub