Description

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

Remediation

References

CVE-2020-11110

Related Vulnerabilities

WordPress Plugin Photo Gallery, Images, Slider in Rbs Image Gallery Cross-Site Request Forgery (3.2.11)

WordPress URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-16220)

PostgreSQL NULL Pointer Dereference Vulnerability (CVE-2016-5423)

WordPress Plugin LIQUID SPEECH BALLOON Cross-Site Scripting (1.0.6)

Oracle Database Server CVE-2008-0340 Vulnerability (CVE-2008-0340)

Severity

Medium

Classification

CVE-2020-11110 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities