CVE-2020-11110 Information
Share on:
Feb 14, 2021
cve
Description
Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reference
https://github.com/grafana/grafana/blob/master/CHANGELOG.md https://security.netapp.com/advisory/ntap-20200810-0002/
Attack Complexity
LOW
Privileges Required
NONE
User Interaction Required
NONE
Scope
REQUIRED
Confidentiality Impact
CHANGED
Integrity Impact
LOW
Availability Impact
LOW
Base Score
NONE
Base Severity
6.1