PT-2020-13536 · Grafana+4 · Grafana+4

Published 2020-05-24 · Updated 2024-06-28 · CVE-2020-13430

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 7.0.0

Description The issue allows tag value XSS via the OpenTSDB datasource. This can be exploited in Grafana, potentially affecting devices that use the OpenTSDB datasource. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the OpenTSDB datasource to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALSA-2020:4682

ALT-PU-2020-2045

ALT-PU-2020-2204

BIT-GRAFANA-2020-13430

CESA-2020_4682

CVE-2020-13430

ECHO-2387-CB23-DD37

GHSA-7M2X-QHRQ-RP8H

GO-2024-2515

RHSA-2020:2796

RHSA-2020:2861

RHSA-2020:4682

RHSA-2020_4682

Affected Products

Alt Linux

Almalinux

Centos

Grafana

Red Hat

References · 24

• https://github.com/grafana/grafana/pull/24539 · Patch
• https://osv.dev/vulnerability/GO-2024-2515 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13430 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7m2x-qhrq-rp8h · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13430 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2020:4682 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-grafana-2020-13430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13430 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13430 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4682.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13430 · Security Note
• https://github.com/grafana/grafana · Note
• https://github.com/grafana/grafana/releases/tag/v7.0.0 · Note
• https://t.me/cvenotify/4033 · Telegram Post
• https://github.com/advisories/GHSA-7m2x-qhrq-rp8h · Note