CVSS 3.0
5.4 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NCVE-2019-13068
Medium (5.4) in grafana grafana. EPSS 52% chance of exploitation in the next 30 days. Fixed in github.com/grafana/grafana 6.2.5.
public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).
Severity
- EPSS
- 52% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- grafana:grafana
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7phr-6cc9-4m5q | Go | github.com/grafana/grafana | <6.2.5 | 6.2.5 |
References
- http://packetstormsecurity.com/files/171500/Grafana-6.2.4-HTML-Injection.html
- https://github.com/grafana/grafana/issues/17718
- https://github.com/grafana/grafana/releases/tag/v6.2.5
- https://security.netapp.com/advisory/ntap-20190710-0001/
- http://packetstormsecurity.com/files/171500/Grafana-6.2.4-HTML-Injection.html