VYPR
← All advisories
Moderate severityNVD Advisory· Published Oct 28, 2020· Updated Aug 4, 2024

CVE-2020-24303

CVE-2020-24303

Description

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Grafana before 7.1.0-beta1 permits stored XSS via a crafted Elasticsearch query alias, allowing attackers to execute JavaScript in dashboard viewers' browsers.

Vulnerability

Overview

CVE-2020-24303 describes a stored Cross-Site Scripting (XSS) vulnerability in Grafana, affecting versions prior to 7.1.0-beta1. The flaw exists in how the Elasticsearch datasource handles query aliases: an attacker can inject malicious JavaScript code into the query alias field, which is later rendered in the dashboard UI without proper sanitization or output encoding. [1] [3]

Attack

Vector and Prerequisites

To exploit this vulnerability, an attacker must have write access to a Grafana dashboard (i.e., be able to create or edit panels that use the Elasticsearch datasource). The attacker then creates a query with a malicious alias containing JavaScript payloads, such as ``. When any user views the affected dashboard, the injected script executes in their browser context. No additional user interaction is required beyond viewing the dashboard. [4]

Potential

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of any dashboard viewer. This can lead to session hijacking, data exfiltration (including queries, secrets, or CSRF tokens), defacement of dashboards, or redirection to malicious sites. The impact is amplified in multi-tenant Grafana instances where attackers and targets share a Grafana server but may belong to different organizations. [1] [4]

Mitigation

Status

The vulnerability is fixed in Grafana version 7.1.0-beta1 and later. Users are strongly advised to upgrade to this version or newer. The fix was implemented in pull request #25401, which sanitizes series override aliases to prevent script injection. If an upgrade is not immediately possible, restricting dashboard editing permissions to trusted users is a recommended workaround. [1] [3] [4]

References
  1. NVD - CVE-2020-24303
  2. grafana/CHANGELOG.md at main · grafana/grafana
  3. Graph: Fix XSS vulnerability with series overrides by dprokop · Pull Request #25401 · grafana/grafana

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/grafana/grafanaGo
< 7.1.0-beta17.1.0-beta1

Affected products

90

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.