Grafana version < 6.7.3 is vulnerable for annotation popup XSS.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-cloudwatchUpgrade grafana-prometheusUpgrade grafana-mysqlUpgrade grafanaUpgrade grafana-mssqlUpgrade grafana-influxdbUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-lokiUpgrade grafana-azure-monitorUpgrade grafana-graphiteUpgrade grafana-postgresUpgrade grafana-opentsdb | May 4, 2022 | Apr 27, 2020 |
| Centos_linux | — | Upgrade grafana-debuginfoUpgrade grafana-graphiteUpgrade grafana-stackdriverUpgrade grafana-influxdbUpgrade grafana-mssqlUpgrade grafana-postgresUpgrade grafana-lokiUpgrade grafana-mysqlUpgrade grafana-opentsdbUpgrade grafana-elasticsearchUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade grafana-prometheusUpgrade grafana | Nov 5, 2020 | Apr 27, 2020 |
| Oracle_linux | — | Upgrade grafana-cloudwatchUpgrade grafana-elasticsearchUpgrade grafana-graphiteUpgrade grafana-azure-monitorUpgrade grafana-opentsdbUpgrade grafana-mssqlUpgrade grafana-influxdbUpgrade grafanaUpgrade grafana-postgresUpgrade grafana-mysqlUpgrade grafana-prometheusUpgrade grafana-stackdriverUpgrade grafana-loki | Nov 12, 2020 | Apr 27, 2020 |
| Redhat_linux | — | Upgrade grafana-opentsdbUpgrade grafana-postgresUpgrade grafana-graphiteUpgrade grafana-debuginfoUpgrade grafana-influxdbUpgrade grafana-azure-monitorUpgrade grafana-lokiUpgrade grafana-mysqlUpgrade grafana-cloudwatchUpgrade grafana-stackdriverUpgrade grafana-mssqlUpgrade grafanaUpgrade grafana-prometheusUpgrade grafana-elasticsearch | Nov 5, 2020 | Apr 27, 2020 |
| Suse | — | Upgrade system-user-grafana | Jun 9, 2021 | Apr 27, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub