MEDIUM6.1
GHSA-mvpr-q6rh-8vrp
Grafana XSS via a query alias for the ElasticSearch datasource
Quick fix
GHSA-mvpr-q6rh-8vrp — github.com/grafana/grafana: upgrade to the fixed version with the command below.
go get github.com/grafana/grafana@v7.1.0-beta1Details
Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/grafana/grafana
Introduced in:
0Fixed in: 7.1.0-beta1Fix
go get github.com/grafana/grafana@v7.1.0-beta1