{"id":"CVE-2018-12099","aliases":["EUVD-2024-0432","GHSA-v5gq-qvjq-8p53","GO-2024-2510","RHSA-2019:0911","SUSE-SU-2018:2317-1","SUSE-SU-2018:2536-1","SUSE-SU-2020:1273-1","UBUNTU-CVE-2018-12099"],"status":"published","title":"Grafana Cross-site Scripting (XSS)","description":"Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02115,"percentile":0.81982,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2018-06-11T11:00:00Z","modified":"2026-10-20T10:53:43Z","fixes":[{"ecosystem":"Go","package":"github.com/grafana/grafana","fixed_in":["5.2.0-beta1","5.2.0-beta1+incompatible"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-beta1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.0-beta1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.0-beta1+incompatible"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.15-1.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.4-2.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.8-128.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0.1-5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"logstash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-5.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180622_15.06-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0.1-5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"logstash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-5.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180622_15.06-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0.1-5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"logstash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-5.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180622_15.06-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2.2-5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"logstash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180608_12.47-9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5-3.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"netapp","product":"active_iq_performance_analytics_services"},{"vendor":"netapp","product":"storagegrid_webscale_nas_bridge"}],"references":[{"url":"https://github.com/grafana/grafana/pull/11813","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/grafana/grafana/releases/tag/v5.2.0-beta1","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20190416-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12099","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v5gq-qvjq-8p53","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190416-0004","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0911","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/3.2/html/release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506782","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1540881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1593110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1600138","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1636251","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1638092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1639833","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1648168","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1653307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1656935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1660962","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1664869","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668362","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672878","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1673687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1674549","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1678470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1679263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1680171","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684289","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685733","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1687038","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1687039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1687041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1687567","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1687828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1688330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1688378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1688541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1688869","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1689266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1689410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1692555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695174","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1699478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1701970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702311","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0911.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1590017","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12099","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-19039","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19039","tags":["advisory"]},{"url":"https://community.grafana.com/t/grafana-5-3-3-and-4-6-5-security-update/11961","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182317-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1090336","tags":["report"]},{"url":"https://bugzilla.suse.com/1090849","tags":["report"]},{"url":"https://bugzilla.suse.com/1094448","tags":["report"]},{"url":"https://bugzilla.suse.com/1095603","tags":["report"]},{"url":"https://bugzilla.suse.com/1096985","tags":["report"]},{"url":"https://bugzilla.suse.com/1097847","tags":["report"]},{"url":"https://bugzilla.suse.com/1101366","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3817","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182536-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1086909","tags":["report"]},{"url":"https://bugzilla.suse.com/1090192","tags":["report"]},{"url":"https://bugzilla.suse.com/1090343","tags":["report"]},{"url":"https://bugzilla.suse.com/1102920","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1288","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201273-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1106515","tags":["report"]},{"url":"https://bugzilla.suse.com/1115960","tags":["report"]},{"url":"https://bugzilla.suse.com/1139862","tags":["report"]},{"url":"https://bugzilla.suse.com/1148383","tags":["report"]},{"url":"https://bugzilla.suse.com/1167424","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-558213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15043","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-12099","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-12099","description":"Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.","status":"published","published":"2018-06-11T11:00:00Z","modified":"2024-08-05T08:24:03.598Z","updated_at":"2026-11-02T14:35:06.679212Z"}],"euvd":[{"id":"EUVD-2024-0432","description":"Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.","status":"published","published":"2018-06-11T11:00:00Z","modified":"2024-08-05T08:24:03Z","updated_at":"2026-11-03T02:39:53.575925Z"}],"ghsa":[{"id":"GHSA-v5gq-qvjq-8p53","title":"Grafana Cross-site Scripting (XSS)","description":"Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.","status":"published","published":"2024-01-31T23:28:40Z","modified":"2024-01-31T23:28:40Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:34.405364Z"}],"nvd":[{"id":"CVE-2018-12099","description":"Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.","status":"published","published":"2018-06-11T11:29:00.413Z","modified":"2026-06-17T01:37:09.19Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:29.837913Z"}],"osv":[{"id":"CVE-2018-12099","description":"Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.","status":"published","published":"2018-06-11T11:29:00.413Z","modified":"2026-10-20T10:53:43.148834938Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"GHSA-v5gq-qvjq-8p53","title":"Grafana Cross-site Scripting (XSS)","description":"Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.","status":"published","published":"2024-01-31T23:28:40Z","modified":"2024-06-28T15:58:31.790589Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"RHSA-2019:0911","title":"Red Hat Security Advisory: Red Hat Ceph Storage 3.2 security, bug fix, and enhancement update","status":"published","published":"2024-09-18T04:09:31Z","modified":"2026-06-28T10:29:07Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-12099","description":"Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.","status":"published","published":"2018-06-11T11:29:00Z","modified":"2025-10-24T04:47:03Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"GO-2024-2510","title":"Grafana Cross-site Scripting (XSS) in github.com/grafana/grafana","description":"Grafana Cross-site Scripting (XSS) in github.com/grafana/grafana","status":"published","published":"2024-06-28T15:28:53Z","modified":"2026-03-03T04:54:35.862598Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"SUSE-SU-2018:2317-1","title":"Security update for grafana, kafka, logstash, openstack-monasca-installer","description":"This update for grafana, kafka, logstash, openstack-monasca-installer fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-12099: grafana: Fix XSS vulnerabilities in dashboard links (bsc#1096985).\n- CVE-2018-3817: logstash: Fix inadvertently logging of sensitive information (bsc#1090849).\n\nBug fixes:\n\n- bsc#1095603: Disable jmxremote debugging.\n- bsc#1097847: Make time series database schema setup conditional.\n- bsc#1094448: Set log rotation options.\n- bsc#1090336: Add complete set of elasticsearch performance tunables.\n- bsc#1101366: Fix build issues with s390x, ppc64le and aarch64.\n- Fix various spec errors affecting Leap 15 and Tumbleweed \n","status":"published","published":"2018-08-14T06:03:57Z","modified":"2026-02-04T03:13:39.555169Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2536-1","title":"Security update for grafana, kafka, logstash and monasca-installer","description":"This update for grafana, kafka, logstash and monasca-installer fixes the following issues:\n\nThe following security issues have been fixed:\n\ngrafana:\n\n- CVE-2018-12099: Fix Cross-Site-Scripting (XSS) vulnerabilities in dashboard links. (bsc#1096985)\n\nkafka:\n\n- CVE-2018-1288: Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch\n  request interfering with data replication, resulting in data loss. (bsc#1102920)\n\nlogstash:\n\n- CVE-2018-3817: Fix potential leak of sensitive data when logging warnings about deprecated options. (bsc#1090849)\n\nAdditionally, the following non-security issues have been fixed:\n\nmonasca-installer:\n\n- Add complete set of elasticsearch performance tunables.\n- Update to version Build_20180427_14.04 (bsc#1090192, bsc#1090343)\n- Fix bad elasticsearch-curator configuration. (bsc#1090192)\n- Enable bootstrap.memory_lock for Elasticsearch. (bsc#1090343)\n\nlogstash:\n\n- Declare Gemfile as config to prevent loss of installed plugins when updating.\n- Stop installing prebuilt jruby for non-x86.\n\nkafka: \n\n- Update to version 0.10.2.2 (bsc#1102920, CVE-2018-1288)\n- Add noreplace directive for /etc/kafka/server.properties.\n- Reduce package ownership of tmpfiles.d to bare minium. (SLE12 SP2) \n- Set log rotation options. (bsc#1094448)\n- Disable jmxremote debugging. (bsc#1095603)\n- Increase open file limits. (bsc#1086909)\n","status":"published","published":"2018-08-28T09:05:28Z","modified":"2026-02-04T03:02:59.047298Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2020:1273-1","title":"Security update for grafana","description":"This update for grafana to version 4.6.5 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-15043: Added authentication to a few rest endpoints (jsc#SOC-10357, bsc#1148383).\n- CVE-2018-19039: Fixed File Exfiltration vulnerability (jsc#SOC-9976 bsc#1115960).\n- CVE-2018-15727: Fixed an LDAP and OAuth login vulnerability (jsc#SOC-9980 bsc#1106515).\n- CVE-2018-12099: Fixed cross site scripting vulnerabilities in dashboard links (bsc#1096985).\n- CVE-2019-13068: Fixed an HTML injection in the panel drilldown links (bsc#1139862).\n\nNon-security issue fixed:\n\n- Solve wrongly categorized 'default.ini' file. (bsc#1167424)\n  The configuration file was wrongly classified as documentation instead of configuration file.\n  In systems where the documentation isn't installed by default was not possible to start the 'grafana server' service.\n","status":"published","published":"2020-05-13T14:23:49Z","modified":"2026-02-04T04:12:16.935952Z","updated_at":"2026-11-02T15:53:47.634847Z"}]}}