CVE-2020-13430

Aliases:GHSA-7m2x-qhrq-rp8hBIT-grafana-2020-13430GO-2024-2515CGA-24r3-qjqw-6jv3CGA-277r-x7j3-2825CGA-27pv-g9gw-2j39CGA-2q5f-2xq4-73c7CGA-34h7-rvj5-jcxxCGA-35qm-rp4q-v484CGA-3jv5-xqqw-q8hcCGA-3p35-698m-x82mCGA-3r7r-47f9-xvj4CGA-4mwr-h424-w2c4CGA-5549-j298-xcmgCGA-5897-j6xj-jjc7CGA-5qfq-5xq6-544rCGA-7j85-5vgg-wg84CGA-7r4c-56wf-4f86CGA-8733-hxqr-796vCGA-88v2-x626-wm3vCGA-8c7m-j59g-jvj5CGA-8hmx-pp8f-fc5wCGA-8pq8-wg6m-fh3pCGA-93w7-j3xq-j9c5CGA-9mm5-x5rc-p5mfCGA-9v43-cc3x-7jjxCGA-9vmf-c9vc-h7w7CGA-cgv6-wfmj-cj8cCGA-f3r2-pr2v-2836CGA-f57j-qh6j-g7q3CGA-fq5h-pr9v-prhxCGA-g75p-rjhf-2q89CGA-h4c5-4pgx-vmvwCGA-h569-823w-mjw8CGA-hpjv-3xm2-822mCGA-hxg9-qpph-32j3CGA-jcrg-m4pj-8cqqCGA-mr23-m7jw-cgc2CGA-mr9j-5mwh-6hg3CGA-r7j9-3c5w-48q2CGA-w69w-g5w2-ch3rCGA-w75x-wj7c-mr3gCGA-wgjf-c46c-2rfw
Advisory lineage Upstream: 0 Downstream: 4
Modified
Published: 24 May 2020, 17:24
Last modified:04 Aug 2024, 12:18

Vulnerability Summary

Overall Risk (default)
medium
25/100
CVSS Score
6.1 MEDIUM
v3.1 (nvd)
EPSS Score
1.84% LOW
2% probability +1.43%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

24 May 2020, 17:24
Published
Vulnerability first disclosed
04 Aug 2024, 12:18
Last Modified
Vulnerability information updated

Description

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
  • v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 1.84%• Percentile: 78%

Techniques & Countermeasures

  • CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Systems

  • chainguard•grafana-fips-11.6

    < 0

  • chainguard•grafana-fips-12.0

    < 12.0.10-r6

  • chainguard•grafana-fips-12.1

    < 12.1.10.01-r3

  • chainguard•grafana-fips-12.2

    < 0

  • chainguard•grafana-fips-12.3

    < 0

  • chainguard•grafana-fips-12.4

    < 0

  • chainguard•grafana-fips-13.0

    < 0

  • chainguard•grafana-fips-13.1

    < 13.1.0-r0

  • github.com/grafana•grafana

    all | < 7.0.0

  • grafana•grafana

    < 7.0.0

References (7)