.. / CVE-2020-11110

• XSS
• Nuclei
• Web

Exploit for Grafana <= 6.7.1 - Cross-Site Scripting (CVE-2020-11110)

Description:

Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

Nuclei Template

View the template here CVE-2020-11110.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-11110.yaml

References: