What’s Vulnerable › Vulnerabilities

CVE-2023-4399

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-17 · updated 2026-06-17
• Weakness: CWE-183

Description

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the characters in the request address.

Affected products

• Grafana: from 9.4.0 before 9.4.17; from 9.5.0 before 9.5.13; from 10.0.0 before 10.0.9; from 10.1.0 before 10.1.5 — fixed in 10.0.9, 10.1.5, 9.4.17, 9.5.13

How to fix

Upgrade to a fixed version: Grafana 10.0.9, 10.1.5, 9.4.17, 9.5.13. Check the vendor advisory for mitigations.

References

• https://grafana.com/security/security-advisories/cve-2023-4399/
• https://security.netapp.com/advisory/ntap-20231208-0003/
• https://grafana.com/security/security-advisories/cve-2023-4399/
• https://security.netapp.com/advisory/ntap-20231208-0003/

Get alerted when CVE-2023-4399 or the next vulnerability affects your stack