CVE-2019-13068 - public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field)

MEDIUM

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field)

Published Jun 29, 2019

5.4

MEDIUM

CVSS 3.0

EPSS 51.91%

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

Ecosystem	Package	Introduced	Fixed
Go	github.com/grafana/grafana	0	6.2.5

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
http://packetstormsecurity.com/files/171500/Grafana-6.2.4-HTML-Injection.html
https://github.com/advisories/GHSA-7phr-6cc9-4m5q		Advisory
https://github.com/grafana/grafana/issues/17718		Third Party Advisory
https://github.com/grafana/grafana/releases/tag/v6.2.5		Release NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-13068
https://security.netapp.com/advisory/ntap-20190710-0001/