CVE-2015-9282

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/grafana/grafana/issues/4117Issue Tracking, Third Party Advisory
https://github.com/grafana/piechart-panel/issues/3Issue Tracking, Third Party Advisory
https://github.com/grafana/piechart-panel/pull/163Issue Tracking, Patch, Third Party Advisory
https://padlock.argh.in/2019/02/05/exploiting-xss-grafana.htmlExploit, Third Party Advisory
https://github.com/grafana/grafana/issues/4117Issue Tracking, Third Party Advisory
https://github.com/grafana/piechart-panel/issues/3Issue Tracking, Third Party Advisory
https://github.com/grafana/piechart-panel/pull/163Issue Tracking, Patch, Third Party Advisory
https://padlock.argh.in/2019/02/05/exploiting-xss-grafana.htmlExploit, Third Party Advisory

Timeline

Published: Feb 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-92848.8The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on CVE-2015-92856.1esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.CVE-2015-92866.1Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.CVE-2015-92879.8Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP CVE-2015-92886.5The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's CVE-2015-92895.5In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maxi CVE-2015-92909.8In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new CVE-2015-92917.5cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).CVE-2015-92928.86kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).CVE-2015-92936.1The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.CVE-2015-92946.1The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.CVE-2015-92956.1The contact-form-plugin plugin before 3.96 for WordPress has XSS.