CVE-2018-1000816 Grafana XSS Vulnerability

What is CVE-2018-1000816?

CVE-2018-1000816 is a medium-severity cross-site scripting vulnerability in Grafana Grafana, published on 20 Dec 2018. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted..

Weakness: CWE-79

Which versions are affected by CVE-2018-1000816?

2 open source packages ship an affected version, including github.com/grafana/grafana. It affects 1 product.

Products include Grafana Grafana.

How do I fix CVE-2018-1000816?

Upgrade github.com/grafana/grafana to 5.3.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-1000816 being exploited?

There is no known exploitation of CVE-2018-1000816 in the wild and no public exploit code.

Other vulnerabilities in Grafana Grafana

• CVE-2021-43798 Grafana Path Traversal Exploited High 7.5
• CVE-2025-41115 Incorrect privilege assignment Critical 10.0
• CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation Critical 9.8
• CVE-2022-28660 Auth bypass in n/a Critical 9.8
• CVE-2022-26148 Information disclosure in n/a Critical 9.8

All Grafana Grafana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x5fh-fvvr-892f, UBUNTU-CVE-2018-1000816.