Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-prometheusUpgrade grafanaUpgrade grafana-cloudwatchUpgrade grafana-azure-monitorUpgrade grafana-elasticsearchUpgrade grafana-mysqlUpgrade grafana-opentsdbUpgrade grafana-mssqlUpgrade grafana-stackdriverUpgrade grafana-postgresUpgrade grafana-graphiteUpgrade grafana-influxdbUpgrade grafana-loki | May 4, 2022 | May 24, 2020 |
| Centos_linux | — | Upgrade grafana-elasticsearchUpgrade grafana-azure-monitorUpgrade grafana-cloudwatchUpgrade grafana-stackdriverUpgrade grafana-opentsdbUpgrade grafana-lokiUpgrade grafana-influxdbUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-mssqlUpgrade grafana-debuginfoUpgrade grafanaUpgrade grafana-mysqlUpgrade grafana-postgres | Nov 5, 2020 | May 24, 2020 |
| Oracle_linux | — | Upgrade grafana-cloudwatchUpgrade grafana-influxdbUpgrade grafana-postgresUpgrade grafana-graphiteUpgrade grafana-prometheusUpgrade grafana-opentsdbUpgrade grafana-lokiUpgrade grafana-azure-monitorUpgrade grafanaUpgrade grafana-mssqlUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-mysql | Nov 12, 2020 | May 24, 2020 |
| Redhat_linux | — | Upgrade grafana-influxdbUpgrade grafana-mysqlUpgrade grafana-lokiUpgrade grafana-debuginfoUpgrade grafana-prometheusUpgrade grafana-graphiteUpgrade grafanaUpgrade grafana-postgresUpgrade grafana-mssqlUpgrade grafana-opentsdbUpgrade grafana-azure-monitorUpgrade grafana-stackdriverUpgrade grafana-elasticsearchUpgrade grafana-cloudwatch | Nov 5, 2020 | May 24, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub