Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
References
Link | Resource |
---|---|
https://github.com/grafana/grafana/blob/master/CHANGELOG.md | Release Notes Third Party Advisory |
https://security.netapp.com/advisory/ntap-20200810-0002/ | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-07-27T12:48:30
Updated: 2020-08-10T11:06:08
Reserved: 2020-03-30T00:00:00
Link: CVE-2020-11110
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-07-27T13:15:11.293
Modified: 2023-02-10T18:04:39.533
Link: CVE-2020-11110
JSON object: View
Redhat Information
No data.
CWE