ChainGo:github.com/grafana/grafana
github.com/grafana/grafana: incomplete fixes (2018)
4 CVEs over 2 generations, 11 Jun 2018 to 2 Jun 2020.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2018-1209911 Jun 2018 First in the chain
- CVE-2018-186232 Jun 2020 incomplete fix for CVE-2018-12099
- CVE-2018-186242 Jun 2020 incomplete fix for CVE-2018-12099
- CVE-2018-186252 Jun 2020 incomplete fix for CVE-2018-12099
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2018-12099 | 11 Jun 2018 | Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links · fixed in 5.2.0-beta1+incompatible | First in chain | 16.4 |
| CVE-2018-18623 | 2 Jun 2020 | Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen · fixed in 6.0.0-beta1+incompatible | CVE-2018-12099 · incomplete fix · High | 15.7 |
| CVE-2018-18624 | 2 Jun 2020 | Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen · fixed in 7.0.0 | CVE-2018-12099 · incomplete fix · High | 14.5 |
| CVE-2018-18625 | 2 Jun 2020 | Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen | CVE-2018-12099 · incomplete fix · High | 14.4 |