CVE-2020-12052: 
Grafana vulnerability analysis and mitigation

Grafana versions prior to 6.7.3 were found to be vulnerable to a Cross-Site Scripting (XSS) vulnerability in the annotation popup feature. The vulnerability was assigned CVE-2020-12052 and was disclosed in April 2020. This security issue affected Grafana installations across multiple platforms and distributions (NVD, NetApp Advisory).

The vulnerability was assessed with a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed with low impacts to confidentiality and integrity, but no impact to availability (NVD).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information or addition/modification of data through cross-site scripting attacks (NetApp Advisory).

The vulnerability requires user interaction and is network accessible. While specific exploit details are not publicly disclosed, the vulnerability was confirmed to be exploitable through the annotation popup feature in affected Grafana versions (Grafana Release Notes).

The vulnerability was patched in Grafana version 6.7.3. Users are advised to upgrade to this version or later to mitigate the risk. The fix was released as part of the security patches in the 6.7.3 release (Grafana Release Notes).