CVE-2020-11110

moderate-risk

Published 2020-07-27

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

Do I need to act?

61.6% chance of exploitation in next 30 days

EPSS score — higher than 38% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (2)

Grafana

E-Series Performance Analyzer

Affected Vendors

Netapp Grafana

References (4)

Release Notes https://github.com/grafana/grafana/blob/master/CHANGELOG.md

Third Party Advisory https://security.netapp.com/advisory/ntap-20200810-0002/

Release Notes https://github.com/grafana/grafana/blob/master/CHANGELOG.md

Third Party Advisory https://security.netapp.com/advisory/ntap-20200810-0002/

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 19/34 · Moderate

Exposure 7/34 · Low