Every CVE Search/ Get API key

CVE-2020-13430

Grafana XSS via the OpenTSDB datasource

6.1 MediumFix available

CVE-2020-13430 is a medium vulnerability (CVSS 6.1) in Grafana, published May 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.87%, the 79th percentile. Fixed in github.com/grafana/grafana 7.0.0.

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.87%Up 1.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

Record
CVE-2020-13430
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

Record
CVE-2020-13430
Updated
2026-11-02
EUVDEUVD-2022-3028 No score

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

Record
EUVD-2022-3028
Updated
2026-11-03
GitHub AdvisoriesGHSA-7m2x-qhrq-rp8h 5.1

Grafana XSS via the OpenTSDB datasource

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

Record
GHSA-7m2x-qhrq-rp8h
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

Record
CVE-2020-13430
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-7m2x-qhrq-rp8h 5.1

Grafana XSS via the OpenTSDB datasource

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

Record
GHSA-7m2x-qhrq-rp8h
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
Show 7 moreShow less
OSVRHSA-2020:2796 8.2

Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update

Record
RHSA-2020:2796
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:2861 8.2

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update

Record
RHSA-2020:2861
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:4682 6.5

Red Hat Security Advisory: grafana security, bug fix, and enhancement update

Record
RHSA-2020:4682
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-13430 6.1

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

Record
UBUNTU-CVE-2020-13430
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVALSA-2020:4682 No score

Moderate: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (6.7.4). (BZ#1807323)

Security Fix(es):

  • grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen (CVE-2018-18624)

  • grafana: arbitrary file read via MySQL data source (CVE-2019-19499)

  • grafana: stored XSS (CVE-2020-11110)

  • grafana: XSS annotation popup vulnerability (CVE-2020-12052)

  • grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)

  • grafana: information disclosure through world-readable /var/lib/grafana/grafana.db (CVE-2020-12458)

  • grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

  • grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2020:4682
Updated
2026-11-02
OSVBIT-grafana-2020-13430 No score

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

Record
BIT-grafana-2020-13430
Updated
2026-11-02
OSVGO-2024-2515 No score

Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana

Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v7.0.0.

Record
GO-2024-2515
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 before 7.0.0
7.0.0
grafana
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-azure-monitor
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-cloudwatch
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-elasticsearch
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-graphite
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-influxdb
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-loki
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-mssql
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-mysql
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
Show 25 moreShow less
Affected packages
PackageAffectedFixed
grafana-opentsdb
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-postgres
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-prometheus
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana-stackdriver
AlmaLinux:8
 before 6.7.4-3.el8
6.7.4-3.el8
grafana
Bitnami
 before 7.0.0
7.0.0
github.com/grafana/grafana
Go
 All versions None known
servicemesh-grafana
Red Hat:service_mesh:1.1::el8
 before 0:6.4.3-11.el8
0:6.4.3-11.el8
servicemesh-grafana-prometheus
Red Hat:service_mesh:1.1::el8
 before 0:6.4.3-11.el8
0:6.4.3-11.el8
servicemesh-grafana
Red Hat:service_mesh:1.0::el8
 before 0:6.2.2-38.el8
0:6.2.2-38.el8
servicemesh-grafana-prometheus
Red Hat:service_mesh:1.0::el8
 before 0:6.2.2-38.el8
0:6.2.2-38.el8
grafana
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-azure-monitor
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-cloudwatch
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-elasticsearch
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-graphite
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-influxdb
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-loki
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-mssql
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-mysql
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-opentsdb
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-postgres
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-prometheus
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana-stackdriver
Red Hat:enterprise_linux:8::appstream
 before 0:6.7.4-3.el8
0:6.7.4-3.el8
grafana
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.6.0+dfsg-1
 None known

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 75 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open