// For flags

CVE-2023-4399

 

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Grafana is an open-source platform for monitoring and observability.

In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts.

However, the restriction can be bypassed used punycode encoding of the characters in the request address.

Grafana es una plataforma de código abierto para monitorización y observabilidad. En Grafana Enterprise, la seguridad de solicitudes es una lista de denegación que permite a los administradores configurar Grafana de manera que la instancia no llame a hosts específicos. Sin embargo, la restricción se puede eludir utilizando la codificaciówn punycode de los caracteres en la dirección de solicitud.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-08-17 CVE Reserved
  • 2023-10-17 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-09-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-183: Permissive List of Allowed Inputs
CAPEC
  • CAPEC-267: Leverage Alternate Encoding
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Grafana
Search vendor "Grafana"
 Grafana
Search vendor "Grafana" for product "Grafana"
 >= 9.4.0 < 9.4.17
Search vendor "Grafana" for product "Grafana" and version " >= 9.4.0 < 9.4.17"
enterprise
Affected
Grafana
Search vendor "Grafana"
 Grafana
Search vendor "Grafana" for product "Grafana"
 >= 9.5.0 < 9.5.13
Search vendor "Grafana" for product "Grafana" and version " >= 9.5.0 < 9.5.13"
enterprise
Affected
Grafana
Search vendor "Grafana"
 Grafana
Search vendor "Grafana" for product "Grafana"
 >= 10.0.0 < 10.0.9
Search vendor "Grafana" for product "Grafana" and version " >= 10.0.0 < 10.0.9"
enterprise
Affected
Grafana
Search vendor "Grafana"
 Grafana
Search vendor "Grafana" for product "Grafana"
 >= 10.1.0 < 10.1.5
Search vendor "Grafana" for product "Grafana" and version " >= 10.1.0 < 10.1.5"
enterprise
Affected