CVE-2020-11110: 
Grafana vulnerability analysis and mitigation

CVE-2020-11110 is a stored Cross-Site Scripting (XSS) vulnerability affecting Grafana versions through 6.7.1. The vulnerability was disclosed in July 2020 and stems from insufficient input protection in the originalUrl field (NVD, Red Hat).

The vulnerability exists due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code. The code execution occurs after clicking on 'Open Original Dashboard' after visiting the snapshot. The vulnerability has been assigned a CVSS score of 6.1 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NetApp Security).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information or addition/modification of data when a user clicks on the 'Open Original Dashboard' link after visiting an affected snapshot (NetApp Security).

The vulnerability requires user interaction to be exploited, specifically clicking on the 'Open Original Dashboard' link after visiting a snapshot. The attack vector is network-accessible and requires low attack complexity (NetApp Security).

The vulnerability has been fixed in Grafana version 6.7.4. Users are advised to upgrade to this version or later to address the security issue (Red Hat).