CVE-2019-13068: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 24, 2022 (updated March 27, 2023)

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

References

packetstormsecurity.com/files/171500/Grafana-6.2.4-HTML-Injection.html
github.com/advisories/GHSA-7phr-6cc9-4m5q
github.com/grafana/grafana/issues/17718
github.com/grafana/grafana/releases/tag/v6.2.5
nvd.nist.gov/vuln/detail/CVE-2019-13068
security.netapp.com/advisory/ntap-20190710-0001/

Detect and mitigate CVE-2019-13068 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →