{"id":"CVE-2020-24303","published":"2020-10-28T13:25:22Z","modified":"2024-08-04T15:12:08Z","title":"Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource","vendor":null,"product":null,"tier":"tail","description":{"text":"Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02078,"percentile":0.8142,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/grafana/grafana/blob/master/CHANGELOG.md#710-beta-1-2020-07-01","tags":["x_refsource_MISC"]},{"url":"https://github.com/grafana/grafana/pull/25401","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20201123-0002/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":16.3,"factors":[{"name":"EPSS percentile","points":16.28}]},"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":["<7.1.0-beta1","all versions"],"patched":["7.1.0-beta1"],"from":["GHSA-mvpr-q6rh-8vrp","GO-2024-2520"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4628","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2018-18624","published":"2020-06-02","fixed":"7.0.0","kev":false},{"cve":"CVE-2020-13430","published":"2020-05-24","fixed":"7.0.0","kev":false},{"cve":"CVE-2020-13379","published":"2020-06-03","fixed":"7.0.2","kev":false,"link":{"from":"CVE-2020-13379","to":"CVE-2020-24303","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"7.0.2","toFixed":"7.1.0-beta1","daysApart":147}]}},{"cve":"CVE-2020-24303","published":"2020-10-28","fixed":"7.1.0-beta1","kev":false},{"cve":"CVE-2020-12458","published":"2020-04-29","fixed":"7.2.1","kev":false},{"cve":"CVE-2020-12459","published":"2020-04-29","fixed":"7.2.1","kev":false},{"cve":"CVE-2021-27358","published":"2021-03-18","fixed":"7.4.2","kev":false}],"package":"Go:github.com/grafana/grafana"}}