VYPR
← All advisories
Moderate severityNVD Advisory· Published Apr 24, 2020· Updated Aug 4, 2024

CVE-2020-12245

CVE-2020-12245

Description

Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Grafana table panel before 6.7.3 is vulnerable to stored XSS via column.title or cellLinkTooltip fields.

Vulnerability

Overview CVE-2020-12245 is a stored cross-site scripting (XSS) vulnerability in the Grafana table panel, affecting versions prior to 6.7.3. The flaw exists because user-supplied input in the column.title and cellLinkTooltip fields is not properly sanitized before being rendered in the dashboard [1][3]. This allows an attacker to inject arbitrary HTML or JavaScript code that will be executed when a victim views the affected dashboard.

Exploitation

Prerequisites To exploit this vulnerability, an attacker must have the ability to create or edit dashboards containing table panels, or be able to modify existing table panel configurations. This typically requires editor or admin privileges within Grafana. The injected payload is stored in the dashboard configuration and triggers when any user (including those with lower privileges) views the dashboard, making it a stored XSS attack [1][2].

Impact

Successful exploitation enables arbitrary JavaScript execution in the context of the victim's Grafana session. An attacker could steal session cookies, perform actions on behalf of the victim, exfiltrate sensitive data displayed in dashboards, or deface the interface. The severity is rated high due to the potential for privilege escalation and data compromise [3].

Mitigation

The vulnerability was fixed in Grafana version 6.7.3, released on April 23, 2020 [2]. The fix, implemented in pull request #23816, adds proper sanitization of the column.title and cellLinkTooltip fields [1]. Users are strongly advised to upgrade to at least version 6.7.3 or later. No workarounds are documented; upgrading is the recommended action.

References
  1. Security: Fix XSS vulnerability in table panel by torkelo · Pull Request #23816 · grafana/grafana
  2. Release Notes v6.7.x
  3. NVD - CVE-2020-12245

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/grafana/grafanaGo
< 6.7.36.7.3

Affected products

78

Patches

1
0284747c88eb

TablePanel: Fix XSS issue in header column rename (#23816)

https://github.com/grafana/grafanaTorkel ÖdegaardApr 23, 2020via ghsa
commit
1 file changed · +2 −2
  • public/app/plugins/panel/table-old/renderer.ts+2 −2 modified
    @@ -56,7 +56,7 @@ export class TableRenderer {
           column.style = style;
 
           if (style.alias) {
-            column.title = column.text.replace(regex, style.alias);
+            column.title = textUtil.escapeHtml(column.text.replace(regex, style.alias));
           }
 
           break;
@@ -300,7 +300,7 @@ export class TableRenderer {
       const cellLink = this.templateSrv.replace(column.style.linkUrl, scopedVars, encodeURIComponent);
       const sanitizedCellLink = textUtil.sanitizeUrl(cellLink);
 
-      const cellLinkTooltip = this.templateSrv.replace(column.style.linkTooltip, scopedVars);
+      const cellLinkTooltip = textUtil.escapeHtml(this.templateSrv.replace(column.style.linkTooltip, scopedVars));
       const cellTarget = column.style.linkTargetBlank ? '_blank' : '';
 
       cellClasses.push('table-panel-cell-link');

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

12

News mentions

0

No linked articles in our index yet.