medium5.4Public exploit code
CVE-2019-13068
public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Grafana <=6.2.4 - HTML Injection2023-03-27 · webapps · typescript · Verified
Impact
public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grafana | Grafana | before 6.2.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/171500/Grafana-6.2.4-HTML-Injection.html
- https://github.com/grafana/grafana/issues/17718
- https://github.com/grafana/grafana/releases/tag/v6.2.5
- https://security.netapp.com/advisory/ntap-20190710-0001/
- http://packetstormsecurity.com/files/171500/Grafana-6.2.4-HTML-Injection.html
- https://github.com/grafana/grafana/issues/17718
- https://github.com/grafana/grafana/releases/tag/v6.2.5
- https://security.netapp.com/advisory/ntap-20190710-0001/