Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-graphiteUpgrade grafana-lokiUpgrade grafana-stackdriverUpgrade grafana-influxdbUpgrade grafana-mysqlUpgrade grafana-postgresUpgrade grafanaUpgrade grafana-mssqlUpgrade grafana-elasticsearchUpgrade grafana-opentsdbUpgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-prometheus | May 4, 2022 | Jul 27, 2020 |
| Centos_linux | — | Upgrade grafana-stackdriverUpgrade grafana-postgresUpgrade grafana-elasticsearchUpgrade grafanaUpgrade grafana-cloudwatchUpgrade grafana-lokiUpgrade grafana-mysqlUpgrade grafana-mssqlUpgrade grafana-azure-monitorUpgrade grafana-debuginfoUpgrade grafana-graphiteUpgrade grafana-opentsdbUpgrade grafana-influxdbUpgrade grafana-prometheus | Nov 5, 2020 | Jul 27, 2020 |
| Oracle_linux | — | Upgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade grafana-graphiteUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafana-mssqlUpgrade grafana-mysqlUpgrade grafana-prometheusUpgrade grafana-postgresUpgrade grafana-influxdbUpgrade grafana | Nov 12, 2020 | Apr 1, 2020 |
| Redhat_linux | — | Upgrade grafana-postgresUpgrade grafana-lokiUpgrade grafana-mssqlUpgrade grafana-graphiteUpgrade grafanaUpgrade grafana-prometheusUpgrade grafana-influxdbUpgrade grafana-mysqlUpgrade grafana-debuginfoUpgrade grafana-opentsdbUpgrade grafana-elasticsearchUpgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-stackdriver | Nov 5, 2020 | Jul 27, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jul 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub