CVE-2018-18625: 
Grafana vulnerability analysis and mitigation

Grafana 5.3.1 contains a Cross-Site Scripting (XSS) vulnerability that can be exploited via a link on the 'Dashboard > All Panels > General' screen. This vulnerability (CVE-2018-18625) exists due to an incomplete fix for a previous vulnerability (CVE-2018-12099). The issue was discovered in 2018 and publicly disclosed with a CVSS v3.1 base score of 6.1 (MEDIUM) (NVD, NetApp Advisory).

The vulnerability has a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs no privileges, requires user interaction, has changed scope, and can impact confidentiality and integrity with low severity (NVD, NetApp Advisory).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information or addition/modification of data through cross-site scripting attacks (NetApp Advisory).

The vulnerability requires user interaction and can be exploited through the Dashboard > All Panels > General screen. The attack vector involves inserting malicious content in link titles or tooltips (GitHub PR).

The vulnerability was addressed through a fix implemented in Grafana's codebase that prevents XSS attacks in dashboard link components. The fix includes sanitization of link titles and tooltips, as well as additional protection against XSS in absolute URLs (GitHub PR).