Security update for grafana SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2715-1 Final 1 1 2020-09-22T15:11:19Z current 2020-09-22T15:11:19Z 2020-09-22T15:11:19Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for grafana This update for grafana fixes the following issues: - CVE-2020-11110: Fixed a stored XSS in dashboard snapshot original dashboard link (bsc#1174583). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-2715,SUSE-Storage-5-2020-2715 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202715-1/ Link for SUSE-SU-2020:2715-1 https://lists.suse.com/pipermail/sle-security-updates/2020-September/007451.html E-Mail link for SUSE-SU-2020:2715-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1174583 SUSE Bug 1174583 https://www.suse.com/security/cve/CVE-2020-11110/ SUSE CVE CVE-2020-11110 page SUSE Enterprise Storage 5 grafana-4.6.5-3.13.1 grafana-4.6.5-3.13.1 as a component of SUSE Enterprise Storage 5 Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot. CVE-2020-11110 SUSE Enterprise Storage 5:grafana-4.6.5-3.13.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202715-1/ https://www.suse.com/security/cve/CVE-2020-11110.html CVE-2020-11110 https://bugzilla.suse.com/1174583 SUSE Bug 1174583