7.2

CVE-2023-4399

Grafana is an open-source platform for monitoring and observability. 

In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts.

However, the restriction can be bypassed used punycode encoding of the characters in the request address.

Data is provided by the National Vulnerability Database (NVD)
Grafana ≫ Grafana SwEditionenterprise Version >= 9.4.0 < 9.4.17
Grafana ≫ Grafana SwEditionenterprise Version >= 9.5.0 < 9.5.13
Grafana ≫ Grafana SwEditionenterprise Version >= 10.0.0 < 10.0.9
Grafana ≫ Grafana SwEditionenterprise Version >= 10.1.0 < 10.1.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.04% 0.093
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
security@grafana.com 6.6 1.3 4.7
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L
CWE-183 Permissive List of Allowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.