CVE-2019-13068

Grafana Cross-site Scripting vulnerability

5.4 MediumPublic exploitFix available

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

51.9%Up 51.1 points since Apr 14, 2021

What each source reports

NVD Score used 5.4

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

Record: CVE-2019-13068
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

Record: CVE-2019-13068
Updated: 2026-11-02

EUVDEUVD-2022-3041 No score

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

Record: EUVD-2022-3041
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7phr-6cc9-4m5q 5.4

Grafana Cross-site Scripting vulnerability

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

Record: GHSA-7phr-6cc9-4m5q
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 5.4

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

Record: CVE-2019-13068
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-7phr-6cc9-4m5q 5.4

Grafana Cross-site Scripting vulnerability

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

Record: GHSA-7phr-6cc9-4m5q
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVSUSE-SU-2020:1273-1 No score

Security update for grafana

This update for grafana to version 4.6.5 fixes the following issues:

Security issues fixed:

CVE-2019-15043: Added authentication to a few rest endpoints (jsc#SOC-10357, bsc#1148383).
CVE-2018-19039: Fixed File Exfiltration vulnerability (jsc#SOC-9976 bsc#1115960).
CVE-2018-15727: Fixed an LDAP and OAuth login vulnerability (jsc#SOC-9980 bsc#1106515).
CVE-2018-12099: Fixed cross site scripting vulnerabilities in dashboard links (bsc#1096985).
CVE-2019-13068: Fixed an HTML injection in the panel drilldown links (bsc#1139862).

Non-security issue fixed:

Solve wrongly categorized 'default.ini' file. (bsc#1167424) The configuration file was wrongly classified as documentation instead of configuration file. In systems where the documentation isn't installed by default was not possible to start the 'grafana server' service.

Record: SUSE-SU-2020:1273-1
Updated: 2026-11-02

Affected products

grafana

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/grafana/grafana` Go	before 6.2.5	6.2.5
`grafana` SUSE:Enterprise Storage 5 From an advisory covering 6 CVEs	before 4.6.5-3.10.1	4.6.5-3.10.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Grafana <=6.2.4 - HTML Injection	2023-03-27

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-13068 is a medium vulnerability (CVSS 5.4) in Grafana, published June 29, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 51.9%, the 98th percentile. Fixed in github.com/grafana/grafana 6.2.5.

References

Show 14 moreShow less