Skip to content
Fencer Intel
medium 5.4

CVE-2020-11110 json

Grafana stored XSS

published 6y ago modified last mo. also BIT-grafana-2020-11110 , EUVD-2022-5848 , GHSA-xr3x-62qw-vc4w , GO-2024-2523

cvss
5.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
9.6%
EPSS 9.6% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known, plus a Nuclei check

Summary

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

Patch / fix

  • go github.com/grafana/grafana 6.7.2
  • bitnami grafana 6.7.2
  • grafana RHEL 8 6.7.4-3.el8
  • grafana-loki RHEL 8 6.7.4-3.el8
  • grafana-mssql RHEL 8 6.7.4-3.el8
  • grafana-mysql RHEL 8 6.7.4-3.el8
  • grafana-graphite RHEL 8 6.7.4-3.el8
  • grafana-influxdb RHEL 8 6.7.4-3.el8
  • grafana-opentsdb RHEL 8 6.7.4-3.el8
  • grafana-postgres RHEL 8 6.7.4-3.el8

red hat advisories RHSA-2020:4682

  • kibana OpenStack Cloud Crowbar 9, OpenStack Cloud 9 4.6.6-4.9.2
  • grafana OpenStack Cloud Crowbar 9, OpenStack Cloud 9 6.7.4-3.23.2
  • cassandra OpenStack Cloud Crowbar 9, OpenStack Cloud 9 3.11.10-3.3.3
  • python-py OpenStack Cloud Crowbar 9, OpenStack Cloud 9 1.5.4-3.3.2
  • ardana-swift OpenStack Cloud 9 9.0+git.1618235096.90974ed-3.10.2
  • ardana-neutron OpenStack Cloud 9 9.0+git.1615223676.777f0b3-3.25.2
  • openstack-nova OpenStack Cloud Crowbar 9, OpenStack Cloud 9 18.3.1~dev82-3.37.6
  • python-Django1 OpenStack Cloud Crowbar 9, OpenStack Cloud 9 1.11.29-3.25.1

suse advisories SUSE-SU-2021:1962-1SUSE-SU-2020:3309-1SUSE-SU-2020:2911-1SUSE-SU-2020:2876-1SUSE-SU-2020:2715-1

  • grafana AlmaLinux 8 6.7.4-3.el8
  • grafana-loki AlmaLinux 8 6.7.4-3.el8
  • grafana-mssql AlmaLinux 8 6.7.4-3.el8
  • grafana-mysql AlmaLinux 8 6.7.4-3.el8
  • grafana-graphite AlmaLinux 8 6.7.4-3.el8
  • grafana-influxdb AlmaLinux 8 6.7.4-3.el8
  • grafana-opentsdb AlmaLinux 8 6.7.4-3.el8
  • grafana-postgres AlmaLinux 8 6.7.4-3.el8

almalinux advisories ALSA-2020:4682

Is CVE-2020-11110 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-11110 updated cvss 6.1

grafana: stored XSS

  • Red Hat OpenShift Service Mesh 1 servicemesh-grafana, servicemesh-grafana-prometheus
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 2 grafana
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 3 grafana, grafana-container Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 openshift3/grafana
    affected: no fix available “Fix deferred”
  • Red Hat Storage 3 grafana
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 6.7.4-3.el8, grafana-loki 6.7.4-3.el8, grafana-mssql 6.7.4-3.el8, grafana-mysql 6.7.4-3.el8, grafana-graphite 6.7.4-3.el8, grafana-influxdb 6.7.4-3.el8, +7 more
    fixed: vendor fix RHSA-2020:4682
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-grafana v4.6.0-202010061132.p0
    fixed: vendor fix RHSA-2020:4298
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-cli v4.6.0-202010080605.p0, openshift4/ose-ptp v4.6.0-202010200139.p0, openshift4/ose-etcd v4.6.0-202010061132.p0, openshift4/ose-tests v4.6.0-202010120952.p0, openshift4/ose-console v4.6.0-202010100121.p0, openshift4/ose-coredns v4.6.0-202010061132.p0, +79 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

9.62% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
GitHub 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N
OSV 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/grafana/grafana
<6.7.2
all versions
6.7.2
bitnami grafana
<6.7.2
6.7.2

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.