VYPR
← All advisories
Moderate severityNVD Advisory· Published Jun 2, 2020· Updated Aug 5, 2024

CVE-2018-18625

CVE-2018-18625

Description

Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Grafana 5.3.1 stored XSS in dashboard links due to incomplete fix for CVE-2018-12099, allowing persistent script injection.

CVE-2018-18625 is a stored cross-site scripting (XSS) vulnerability in Grafana 5.3.1 that arises from an incomplete fix for CVE-2018-12099 [2]. The flaw exists in the dashboard link functionality, specifically on the 'Dashboard > All Panels > General' screen [1][3].

An attacker with the ability to create or edit dashboards can inject malicious JavaScript into a link field. When other users view the dashboard, the injected script executes in their browser, leading to potential session hijacking or data exfiltration [2].

The original XSS in dashboard links was addressed in pull request #11813 [3], but the fix was incomplete, leaving a vector through text panels. Subsequently, pull request #14984 was merged to properly sanitize text panel content, closing this gap [1].

Users are advised to upgrade to a Grafana version that includes the complete fix. As of June 2020, patched versions were available [1][2].

References
  1. XSS sanitize text panels by jschill · Pull Request #14984 · grafana/grafana
  2. NVD - CVE-2018-18625
  3. fix XSS vulnerabilities in dashboard links by alexanderzobnin · Pull Request #11813 · grafana/grafana

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/grafana/grafanaGo
< 6.0.0-beta16.0.0-beta1

Affected products

239

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.