CVE-2020-12245: 
Grafana vulnerability analysis and mitigation

CVE-2020-12245 affects Grafana versions before 6.7.3, allowing cross-site scripting (XSS) attacks via column.title or cellLinkTooltip in the table panel. The vulnerability was discovered and disclosed in April 2020 (NVD, Grafana Release).

The vulnerability has a CVSS v3.1 Base Score of 6.1 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates the vulnerability is network accessible, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed with low impacts to confidentiality and integrity (NetApp Advisory).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information or addition/modification of data through cross-site scripting attacks targeting the table panel functionality (NetApp Advisory).

The vulnerability requires user interaction and is network accessible. It can be exploited through specially crafted input in the table panel's column.title or cellLinkTooltip fields (NVD).

The vulnerability was fixed in Grafana version 6.7.3. Users should upgrade to version 6.7.3 or later to mitigate this security issue. No other workarounds are available (Grafana Release).