CVE Vulnerabilities

CVE-2023-4399

Published: Oct 17, 2023 | Modified: Dec 08, 2023
CVSS 3.x
7.2
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Grafana is an open-source platform for monitoring and observability.

In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts.

However, the restriction can be bypassed used punycode encoding of the characters in the request address.

Affected Software

Name Vendor Start Version End Version
Grafana Grafana 9.4.0 (including) 9.4.17 (excluding)
Grafana Grafana 9.5.0 (including) 9.5.13 (excluding)
Grafana Grafana 10.0.0 (including) 10.0.9 (excluding)
Grafana Grafana 10.1.0 (including) 10.1.5 (excluding)

References