{"schema_version":"1.7.5","id":"CVE-2020-13430","published":"2020-05-24T18:15:10.097Z","modified":"2026-07-09T00:21:12.786451Z","aliases":["BIT-grafana-2020-13430","GHSA-7m2x-qhrq-rp8h","GO-2024-2515"],"related":["ALSA-2020:4682","CGA-m4xp-j852-pmgc"],"details":"Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/grafana/grafana","events":[{"introduced":"0"},{"fixed":"aee1438ff2f7a8df8d7f2b825f2af9c9edbaa8ed"}],"database_specific":{"cpe":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"7.0.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v7.0.0-beta3","v6.5","v6.0.0-beta1","v5.,2.4","v5.0.0","v5.0.0-beta5","v5.0.0-beta4","v5.0.0-beta3","v5.0.0-beta2","v5.0.0-beta1","v4.6.0-beta1","v4.5.0","v4.5.0-beta1","v4.4.0","v3.1.0-beta1","v3.0.2","v3.0.1","v3.0.0-beta7","v3.0.0-beta6","v2.6.0","v2.6.0-beta1","v2.5.0","v2.0.2","v2.0.1","v2.0.0-beta3","v2.0.0-beta1","v1.9.1","v1.9.0","v1.9.0-rc1","v1.7.0-rc1","v1.6.1","v1.6.0","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.4","v1.0.3","v1.0.2","v1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13430.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/grafana/grafana/releases/tag/v7.0.0"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20200528-0003/"},{"type":"FIX","url":"https://github.com/grafana/grafana/pull/24539"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}