{"id":"CVE-2020-12245","published":"2020-04-24T20:24:48Z","modified":"2024-08-04T11:48:58Z","title":"Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip","vendor":null,"product":null,"tier":"tail","description":{"text":"Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01962,"percentile":0.80261,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/grafana/grafana/blob/master/CHANGELOG.md#673-2020-04-23","tags":["x_refsource_MISC"]},{"url":"https://community.grafana.com/t/release-notes-v6-7-x/27119","tags":["x_refsource_MISC"]},{"url":"https://github.com/grafana/grafana/pull/23816","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20200511-0001/","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00017.html","tags":["vendor-advisory","x_refsource_SUSE"]}],"priority":{"score":16.1,"factors":[{"name":"EPSS percentile","points":16.05}]},"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":["<6.7.3","all versions"],"patched":["6.7.3"],"from":["GHSA-ccmg-w4xm-p28v","GO-2024-2517"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3559","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2019-13068","published":"2019-06-29","fixed":"6.2.5","kev":false},{"cve":"CVE-2019-19499","published":"2020-08-28","fixed":"6.4.4","kev":false},{"cve":"CVE-2020-11110","published":"2020-07-27","fixed":"6.7.2","kev":false},{"cve":"CVE-2020-12245","published":"2020-04-24","fixed":"6.7.3","kev":false},{"cve":"CVE-2018-18624","published":"2020-06-02","fixed":"7.0.0","kev":false},{"cve":"CVE-2020-13430","published":"2020-05-24","fixed":"7.0.0","kev":false},{"cve":"CVE-2020-13379","published":"2020-06-03","fixed":"7.0.2","kev":false,"link":{"from":"CVE-2020-12245","to":"CVE-2020-13379","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"6.7.3","toFixed":"6.7.4","daysApart":40}]}}],"package":"Go:github.com/grafana/grafana"}}