CVE-2023-4399 — Permissive List of Allowed Inputs in Enterprise

CWE-183 — Permissive List of Allowed Inputs3 documents3 sources
Severity
7.2HIGHNVD
CNA6.6
EPSS
0.1%
top 83.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Grafana EnterpriseGrafana
Timeline
PublishedOct 17

Description

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the characters in the request address.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5grafana/grafana_enterprise10.1.0 — 10.1.5+3
▶NVDgrafana/grafana9.4.0 — 9.4.17+3

🔴Vulnerability Details

2
GHSA
GHSA-6676-9pqr-4cw3: Grafana is an open-source platform for monitoring and observability↗2023-10-17
▶
CVEList
CVE-2023-4399: Grafana is an open-source platform for monitoring and observability↗2023-10-17
▶
CVE-2023-4399 — Permissive List of Allowed Inputs | cvebase