Name: CVE-2020-11110: Improper Neutralization of Input During Web Page Generation
Creator: Rapid7
Published: 2020-07-27T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2020-11110, CWE-79, CVSS 5.4, EPSS 0.09619

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

CVSS Details

CVSS 3.1 Base Score: 5.4
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade grafana-lokiUpgrade grafana-mysqlUpgrade grafanaUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafana-stackdriverUpgrade grafana-graphiteUpgrade grafana-azure-monitorUpgrade grafana-opentsdbUpgrade grafana-mssqlUpgrade grafana-elasticsearchUpgrade grafana-cloudwatchUpgrade grafana-prometheus	May 4, 2022	Jul 27, 2020
Centos_linux	—	Upgrade grafana-cloudwatchUpgrade grafana-elasticsearchUpgrade grafanaUpgrade grafana-lokiUpgrade grafana-stackdriverUpgrade grafana-mysqlUpgrade grafana-mssqlUpgrade grafana-postgresUpgrade grafana-debuginfoUpgrade grafana-influxdbUpgrade grafana-prometheusUpgrade grafana-opentsdbUpgrade grafana-azure-monitorUpgrade grafana-graphite	Nov 5, 2020	Jul 27, 2020
Oracle_linux	—	Upgrade grafana-opentsdbUpgrade grafana-mssqlUpgrade grafana-mysqlUpgrade grafana-prometheusUpgrade grafana-postgresUpgrade grafana-lokiUpgrade grafanaUpgrade grafana-influxdbUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-graphite	Nov 12, 2020	Apr 1, 2020
Redhat_linux	—	Upgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafana-prometheusUpgrade grafana-mssqlUpgrade grafana-graphiteUpgrade grafana-debuginfoUpgrade grafana-mysqlUpgrade grafana-lokiUpgrade grafana-opentsdbUpgrade grafanaUpgrade grafana-elasticsearchUpgrade grafana-azure-monitorUpgrade grafana-stackdriverUpgrade grafana-cloudwatch	Nov 5, 2020	Jul 27, 2020
Ubuntu	—	No solution exists	Jun 26, 2025	Jul 27, 2020

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence