VYPR
← All advisories
Moderate severityNVD Advisory· Published Jul 27, 2020· Updated Aug 4, 2024

CVE-2020-11110

CVE-2020-11110

Description

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Grafana ≤6.7.1 stored XSS via unsanitized originalUrl field in dashboard snapshots, enabling arbitrary JavaScript execution.

Vulnerability

CVE-2020-11110 is a stored cross-site scripting (XSS) vulnerability in Grafana versions up to and including 6.7.1. The root cause is insufficient input sanitization of the originalUrl field when creating dashboard snapshots. An attacker can inject arbitrary JavaScript into this field, which is later rendered without proper encoding [1].

Exploitation

To exploit the vulnerability, an attacker must have access to create a dashboard snapshot (a standard feature in Grafana). The malicious payload is placed in the originalUrl parameter. When a victim views the snapshot and clicks the "Open Original Dashboard" link, the injected JavaScript executes in the context of the victim's browser session [1][2]. No additional authentication is required beyond the ability to create snapshots.

Impact

Successful exploitation allows the attacker to perform actions on behalf of the victim, such as stealing session cookies, modifying dashboards, or exfiltrating sensitive data displayed in Grafana. Because the XSS is stored, the payload persists until the snapshot is deleted or the fix is applied.

Mitigation

The vulnerability was fixed in Grafana version 6.7.2, released on April 1, 2020. The fix, implemented in pull request #23254, adds proper sanitization of the originalUrl field [2][4]. Users are strongly advised to upgrade to Grafana 6.7.2 or later. No workaround is available for unpatched versions.

References
  1. NVD - CVE-2020-11110
  2. Security: Fix for dashboard snapshot original dashboard link could contain XSS vulnerability in url by torkelo · Pull Request #23254 · grafana/grafana
  3. grafana/CHANGELOG.md at main · grafana/grafana

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/grafana/grafanaGo
< 6.7.26.7.2

Affected products

254

Patches

1
fb114a75241a

Snapshots: Sanitize orignal url (#23254)

https://github.com/grafana/grafanaTorkel ÖdegaardApr 1, 2020via ghsa
commit
1 file changed · +3 −1
  • public/app/features/dashboard/components/DashNav/DashNav.tsx+3 −1 modified
    @@ -17,6 +17,7 @@ import { DashboardModel } from '../../state';
 import { CoreEvents, StoreState } from 'app/types';
 import { ShareModal } from 'app/features/dashboard/components/ShareModal';
 import { SaveDashboardModalProxy } from 'app/features/dashboard/components/SaveDashboard/SaveDashboardModalProxy';
+import { sanitizeUrl } from 'app/core/utils/text';
 
 export interface OwnProps {
   dashboard: DashboardModel;
@@ -134,6 +135,7 @@ export class DashNav extends PureComponent<Props> {
     const { canStar, canSave, canShare, showSettings, isStarred } = dashboard.meta;
     const { snapshot } = dashboard;
     const snapshotUrl = snapshot && snapshot.originalUrl;
+
     return (
       <div className="navbar">
         {isFullscreen && this.renderBackButton()}
@@ -222,7 +224,7 @@ export class DashNav extends PureComponent<Props> {
               tooltip="Open original dashboard"
               classSuffix="snapshot-origin"
               icon="gicon gicon-link"
-              href={snapshotUrl}
+              href={sanitizeUrl(snapshotUrl)}
             />
           )}

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.