CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2020-11110
Medium (5.4). EPSS 9.6% chance of exploitation in the next 30 days. Fixed in github.com/grafana/grafana 6.7.2.
Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
Severity
- EPSS
- 9.6% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- grafana:grafana
- netapp:e-series_performance_analyzer
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xr3x-62qw-vc4w | Go | github.com/grafana/grafana | <6.7.2 | 6.7.2 |
| GO-2024-2523 | Go | github.com/grafana/grafana | all versions | no fix published |