Grafana version < 6.7.3 is vulnerable for annotation popup XSS.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-opentsdbUpgrade grafana-graphiteUpgrade grafana-postgresUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-influxdbUpgrade grafanaUpgrade grafana-prometheusUpgrade grafana-mysqlUpgrade grafana-lokiUpgrade grafana-mssql | May 4, 2022 | Apr 27, 2020 |
| Centos_linux | — | Upgrade grafana-graphiteUpgrade grafana-mssqlUpgrade grafana-lokiUpgrade grafana-influxdbUpgrade grafana-debuginfoUpgrade grafana-stackdriverUpgrade grafana-postgresUpgrade grafana-mysqlUpgrade grafana-opentsdbUpgrade grafana-prometheusUpgrade grafanaUpgrade grafana-elasticsearchUpgrade grafana-cloudwatchUpgrade grafana-azure-monitor | Nov 5, 2020 | Apr 27, 2020 |
| Oracle_linux | — | Upgrade grafana-lokiUpgrade grafana-stackdriverUpgrade grafana-prometheusUpgrade grafana-mssqlUpgrade grafana-postgresUpgrade grafana-influxdbUpgrade grafanaUpgrade grafana-mysqlUpgrade grafana-opentsdbUpgrade grafana-azure-monitorUpgrade grafana-graphiteUpgrade grafana-cloudwatchUpgrade grafana-elasticsearch | Nov 12, 2020 | Apr 27, 2020 |
| Redhat_linux | — | Upgrade grafana-graphiteUpgrade grafana-opentsdbUpgrade grafana-debuginfoUpgrade grafana-postgresUpgrade grafana-influxdbUpgrade grafana-mssqlUpgrade grafanaUpgrade grafana-cloudwatchUpgrade grafana-lokiUpgrade grafana-mysqlUpgrade grafana-elasticsearchUpgrade grafana-stackdriverUpgrade grafana-prometheusUpgrade grafana-azure-monitor | Nov 5, 2020 | Apr 27, 2020 |
| Suse | — | Upgrade system-user-grafana | Jun 9, 2021 | Apr 27, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub