CVE-2020-24303

Aliases:GHSA-mvpr-q6rh-8vrpBIT-grafana-2020-24303GO-2024-2520CGA-225c-7fr6-fc56CGA-2895-rxch-w33jCGA-2m27-w27m-cprgCGA-2x4r-pqf5-g5xvCGA-37hh-cc33-6vvmCGA-4432-cq8g-9f68CGA-4j3q-7356-w9wvCGA-4jmh-cjm4-f8qrCGA-5gm7-xjpj-fjhmCGA-5gwm-g6mx-3537CGA-5jj8-j5qv-9v7jCGA-5pwr-94w5-vgpxCGA-5w2c-m783-fg5qCGA-67c2-vxv9-q8hxCGA-67wc-6rv6-j96jCGA-6fhq-xqv4-f5cjCGA-6h8p-5j8w-jccrCGA-783c-7vp8-h95pCGA-8chr-r766-g7h7CGA-8m4m-gp5m-795gCGA-9ppq-64cr-v733CGA-9qwv-mmf2-9q53CGA-c782-j9m8-6389CGA-gfqc-763w-3495CGA-ggpr-vpxm-vmgxCGA-h3hp-hpwr-q276CGA-j7w6-7p77-63j2CGA-mc68-6h2r-6f56CGA-pc4h-fx85-cmhvCGA-pc93-vrv3-mm7mCGA-phqc-c4c3-m69pCGA-q77m-3v2x-36grCGA-q8gf-w8qc-w922CGA-rg46-pc8f-fhjhCGA-rr6j-jww9-mfmrCGA-v76q-w4jv-38mhCGA-vjhg-727v-f93fCGA-wj93-vg8x-gh64CGA-xc5m-cfhm-f962CGA-xw55-g9rf-f76x
Advisory lineage Upstream: 0 Downstream: 6
Modified
Published: 28 Oct 2020, 13:25
Last modified:04 Aug 2024, 15:12

Vulnerability Summary

Overall Risk (default)
medium
25/100
CVSS Score
6.1 MEDIUM
v3.1 (nvd)
EPSS Score
2% LOW
2% probability +1.64%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 Oct 2020, 13:25
Published
Vulnerability first disclosed
04 Aug 2024, 15:12
Last Modified
Vulnerability information updated

Description

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
  • v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 2.00%• Percentile: 80%

Techniques & Countermeasures

  • CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Systems

  • chainguard•grafana-fips-11.6

    < 0

  • chainguard•grafana-fips-12.0

    < 12.0.10-r6

  • chainguard•grafana-fips-12.1

    < 12.1.10.01-r3

  • chainguard•grafana-fips-12.2

    < 0

  • chainguard•grafana-fips-12.3

    < 0

  • chainguard•grafana-fips-12.4

    < 0

  • chainguard•grafana-fips-13.0

    < 0

  • chainguard•grafana-fips-13.1

    < 13.1.0-r0

  • github.com/grafana•grafana

    all | < 7.1.0-beta1

  • grafana•grafana

    ≤ 7.0.5

References (7)