Vulnerability Description
Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the characters in the request address.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana | >= 9.4.0, < 9.4.17 |
Related Weaknesses (CWE)
References
- https://grafana.com/security/security-advisories/cve-2023-4399/Vendor Advisory
- https://security.netapp.com/advisory/ntap-20231208-0003/
- https://grafana.com/security/security-advisories/cve-2023-4399/Vendor Advisory
- https://security.netapp.com/advisory/ntap-20231208-0003/
FAQ
What is CVE-2023-4399?
CVE-2023-4399 is a vulnerability with a CVSS score of 6.6 (MEDIUM). Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance does...
How severe is CVE-2023-4399?
CVE-2023-4399 has been rated MEDIUM with a CVSS base score of 6.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-4399?
Check the references section above for vendor advisories and patch information. Affected products include: Grafana Grafana.