CVE-2020-11110 Grafana stored XSS

What is CVE-2020-11110?

CVE-2020-11110 is a medium-severity cross-site scripting vulnerability in Grafana Grafana, published on 27 Jul 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

Weakness: CWE-79

Which versions are affected by CVE-2020-11110?

4 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 2 products.

Products include Grafana Grafana, Netapp E-Series Performance Analyzer.

How do I fix CVE-2020-11110?

Upgrade github.com/grafana/grafana to 6.7.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-11110 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-11110 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in Grafana Grafana

• CVE-2021-43798 Grafana Path Traversal Exploited High 7.5
• CVE-2025-41115 Incorrect privilege assignment Critical 10.0
• CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation Critical 9.8
• CVE-2022-28660 Auth bypass in n/a Critical 9.8
• CVE-2022-26148 Information disclosure in n/a Critical 9.8

All Grafana Grafana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-grafana-2020-11110, GHSA-xr3x-62qw-vc4w, GO-2024-2523, MINI-2g8v-6x8v-3773, MINI-2gvg-x28q-ppm2, MINI-36mv-gpr3-c4cv and 16 more.