CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2020-24303
Medium (6.1) in grafana grafana. EPSS 2.1% chance of exploitation in the next 30 days. Fixed in github.com/grafana/grafana 7.1.0-beta1.
Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
Severity
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- grafana:grafana
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mvpr-q6rh-8vrp | Go | github.com/grafana/grafana | <7.1.0-beta1 | 7.1.0-beta1 |
| GO-2024-2520 | Go | github.com/grafana/grafana | all versions | no fix published |
References
- https://github.com/grafana/grafana/blob/master/CHANGELOG.md#710-beta-1-2020-07-01
- https://github.com/grafana/grafana/pull/25401
- https://security.netapp.com/advisory/ntap-20201123-0002/
- https://github.com/grafana/grafana/blob/master/CHANGELOG.md#710-beta-1-2020-07-01
- https://github.com/grafana/grafana/pull/25401