Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-y46u-m8e4-9qcn
Vulnerability ID VCID-y46u-m8e4-9qcn
Aliases CVE-2018-18624
GHSA-9hv8-4frf-cprf
Summary Grafana XSS via a column style Grafana has a XSS vulnerability via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
cvssv3 6.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-18624.json
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
epss 0.00563 https://api.first.org/data/v1/epss?cve=CVE-2018-18624
cvssv3.1 6.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6.1 https://github.com/grafana/grafana
cvssv4 5.1 https://github.com/grafana/grafana
generic_textual MODERATE https://github.com/grafana/grafana
cvssv3.1 6.1 https://github.com/grafana/grafana/commit/0284747c88eb9435899006d26ffaf65f89dec88e
cvssv4 5.1 https://github.com/grafana/grafana/commit/0284747c88eb9435899006d26ffaf65f89dec88e
generic_textual MODERATE https://github.com/grafana/grafana/commit/0284747c88eb9435899006d26ffaf65f89dec88e
cvssv3.1 6.1 https://github.com/grafana/grafana/pull/11813
cvssv4 5.1 https://github.com/grafana/grafana/pull/11813
generic_textual MODERATE https://github.com/grafana/grafana/pull/11813
cvssv3.1 6.1 https://github.com/grafana/grafana/pull/23816
cvssv4 5.1 https://github.com/grafana/grafana/pull/23816
generic_textual MODERATE https://github.com/grafana/grafana/pull/23816
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2018-18624
cvssv4 5.1 https://nvd.nist.gov/vuln/detail/CVE-2018-18624
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2018-18624
cvssv3.1 6.1 https://security.netapp.com/advisory/ntap-20200608-0008
cvssv4 5.1 https://security.netapp.com/advisory/ntap-20200608-0008
generic_textual MODERATE https://security.netapp.com/advisory/ntap-20200608-0008
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-18624.json
https://api.first.org/data/v1/epss?cve=CVE-2018-18624
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/grafana/grafana
https://github.com/grafana/grafana/commit/0284747c88eb9435899006d26ffaf65f89dec88e
https://github.com/grafana/grafana/pull/11813
https://github.com/grafana/grafana/pull/23816
https://nvd.nist.gov/vuln/detail/CVE-2018-18624
https://security.netapp.com/advisory/ntap-20200608-0008
1850572 https://bugzilla.redhat.com/show_bug.cgi?id=1850572
RHSA-2020:4298 https://access.redhat.com/errata/RHSA-2020:4298
RHSA-2020:4682 https://access.redhat.com/errata/RHSA-2020:4682
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-18624.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/grafana/grafana
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://github.com/grafana/grafana
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/grafana/grafana/commit/0284747c88eb9435899006d26ffaf65f89dec88e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://github.com/grafana/grafana/commit/0284747c88eb9435899006d26ffaf65f89dec88e
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/grafana/grafana/pull/11813
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://github.com/grafana/grafana/pull/11813
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/grafana/grafana/pull/23816
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://github.com/grafana/grafana/pull/23816
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-18624
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-18624
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://security.netapp.com/advisory/ntap-20200608-0008
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://security.netapp.com/advisory/ntap-20200608-0008
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.68304
EPSS Score 0.00563
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:07:48.652256+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9hv8-4frf-cprf/GHSA-9hv8-4frf-cprf.json 38.0.0