CVE-2020-24303
Grafana before 7.1.0 allows XSS via a query alias for the ElasticSearch datasource.
02 / AFFECTED SOFTWARE
Affected packages
52 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/grafana/grafana before v7.1.0-beta1.
Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
Grafana before 7.1.0 allows XSS via a query alias for the ElasticSearch datasource.
05 / REFERENCES
Further evidence
- https://github.com/grafana/grafana/blob/master/CHANGELOG.md#710-beta-1-2020-07-01
- https://github.com/grafana/grafana/pull/25401
- https://security.netapp.com/advisory/ntap-20201123-0002/
- https://github.com/advisories/GHSA-mvpr-q6rh-8vrp
- https://nvd.nist.gov/vuln/detail/CVE-2020-24303
- https://security.netapp.com/advisory/ntap-20201123-0002
- https://github.com/grafana/grafana