GitHub Advisoryadvisory · Go

GHSA-x5fh-fvvr-892f Grafana XSS Vulnerability

MEDIUM Published 2022-05-14 Modified 2023-10-06 Official page ↗
Aliases
CVE-2018-1000816
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-24

Affected packages

• Go github.com/grafana/grafana: < 5.3.2 → fixed in 5.3.2

Description

Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted..

Related

Alias · CVE (1)

  • CVE-2018-1000816 Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References