Skip to content
OpenAdvisories
Medium · 6.1 CVE-2020-12245 BIT-grafana-2020-12245EUVD-2022-3559GHSA-ccmg-w4xm-p28vGO-2024-2517

Grafana XSS in header column rename

Published Apr 24, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: github.com/grafana/grafana Package: grafana Ecosystem: Go Ecosystem: Ubuntu

Description

Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 8 grafana +12 6.7.4-3.el8 RHSA-2020:4682
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Service Mesh 1 servicemesh-grafana +1 6.2.2-38.el8 RHSA-2020:2861, RHSA-2020:2796

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 grafana +12 6.7.4-3.el8 ALSA-2020:4682

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP5 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
SLES 12 SP4 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
SLES 12 SP3 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP5 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
SLES for SAP 12 SP4 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
SLES for SAP 12 SP3 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
SUSE Package Hub 15 SP2 grafana 7.1.5-bp152.3.3.1 openSUSE-SU-2020:1646-1
SUSE Package Hub 15 SP1 grafana 7.1.5-bp151.2.1 openSUSE-SU-2020:1611-1
SUSE OpenStack Cloud Crowbar 9 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
SUSE OpenStack Cloud Crowbar 8 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
SUSE OpenStack Cloud 9 cobbler 2.6.6-49.26.3 SUSE-SU-2020:1970-1
SUSE OpenStack Cloud 9 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
SUSE OpenStack Cloud 8 cobbler 2.6.6-49.26.3 SUSE-SU-2020:1970-1
SUSE OpenStack Cloud 8 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 15 dracut-saltboot 0.1.1590413773.a959db7-1.12.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 golang-github-prometheus-prometheus 2.18.0-3.12.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 grafana 7.0.3-1.9.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 koan 2.9.0-4.15.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 mgr-cfg 4.1.2-1.12.4 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 mgr-custom-info 4.1.1-1.6.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 mgr-daemon +1 4.1.1-1.14.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 mgr-osad 4.1.2-1.15.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 mgr-push 4.1.1-1.6.4 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 rhnlib 4.1.2-3.16.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 spacecmd 4.1.4-3.38.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 spacewalk-client-tools 4.1.5-3.23.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 spacewalk-koan 4.1.1-3.9.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 spacewalk-oscap 4.1.1-3.6.3 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 spacewalk-remote-utils 4.1.1-3.12.4 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 supportutils-plugin-susemanager-client 4.1.2-3.9.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 suseRegisterInfo 4.1.2-3.6.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 system-user-grafana 1.0.0-3.9.1 SUSE-SU-2021:1233-1
SUSE Manager Client Tools 15 uyuni-base 4.1.1-1.3.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 uyuni-common-libs 4.1.5-1.3.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 15 zypp-plugin-spacewalk 1.0.7-3.12.2 SUSE-SU-2020:1972-1
SUSE Manager Client Tools 12 cobbler 2.6.6-49.26.3 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 golang-github-prometheus-prometheus 2.18.0-1.12.2 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 grafana 7.0.3-1.9.3 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 mgr-cfg 4.1.2-1.12.3 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 mgr-custom-info 4.1.1-1.6.1 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 mgr-daemon 4.1.1-1.14.2 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 mgr-osad 4.1.2-1.15.2 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 mgr-push 4.1.1-1.6.3 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 mgr-virtualization 4.1.1-1.14.3 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 rhnlib 4.1.2-21.22.2 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 spacecmd 4.1.4-38.61.2 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 spacewalk-client-tools 4.1.5-52.32.2 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 spacewalk-koan 4.1.1-24.12.2 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 spacewalk-oscap 4.1.1-19.12.1 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 spacewalk-remote-utils 4.1.1-24.15.3 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client 4.1.2-6.15.1 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 suseRegisterInfo 4.1.2-25.9.2 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 uyuni-base 4.1.1-1.3.1 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 uyuni-common-libs 4.1.5-1.3.2 SUSE-SU-2020:1970-1
SUSE Manager Client Tools 12 zypp-plugin-spacewalk 1.0.7-30.21.2 SUSE-SU-2020:1970-1
SUSE HPE Helion OpenStack 8 cobbler 2.6.6-49.26.3 SUSE-SU-2020:1970-1
SUSE HPE Helion OpenStack 8 golang-github-prometheus-node_exporter 0.18.1-1.6.2 SUSE-SU-2020:1970-1
SUSE Enterprise Storage 6 grafana 7.3.1-3.6.1 SUSE-SU-2021:1233-1
SUSE Enterprise Storage 6 system-user-grafana 1.0.0-3.9.1 SUSE-SU-2021:1233-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 7.5.7-1.2 openSUSE-SU-2024:10818-1
openSUSE Leap 15.2 dracut-saltboot 0.1.1590413773.a959db7-lp152.2.3.1 openSUSE-SU-2020:1105-1
openSUSE Leap 15.2 grafana 7.0.3-lp152.2.3.1 openSUSE-SU-2020:0892-1
openSUSE Leap 15.2 grafana-piechart-panel 1.4.0-lp152.2.3.1 openSUSE-SU-2020:0892-1
openSUSE Leap 15.2 grafana-status-panel 1.0.9-lp152.2.3.1 openSUSE-SU-2020:0892-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 grafana +12 6.7.4-3.el8 ELSA-2020-4682

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/grafana/grafana < 6.7.3 6.7.3 GHSA-ccmg-w4xm-p28v
Go github.com/grafana/grafana all versions — GO-2024-2517

Advisories 14

References