MEDIUM✓ PATCH🇬🇧 English

CVE-2023-4399

CVSS 6.6v3.1pub. 2023-10-17upd. 2025-02-13

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the characters in the request address.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L

  • Grafana

    APP
    Grafana
    9.4.0 – 9.4.17 (bez)9.5.0 – 9.5.13 (bez)10.0.0 – 10.0.9 (bez)10.1.0 – 10.1.5 (bez)
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
CWE
Referencje

Powiązane podatności

CVE-2021-39226CRITICAL9.8⚠ KEVten sam produkt

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated ...

CVE-2026-27876CRITICAL9.1PL ✓ten sam produkt

RCE w Grafana przez SQL Expressions i plugin Enterprise (CVE-2026-27876)

CVE-2025-41115CRITICAL10.0PL ✓ten sam produkt

Grafana Enterprise: privilege escalation przez SCIM provisioning (LPE)

CVE-2024-9264CRITICAL9.4PL ✓ten sam produkt

Grafana: command injection i local file inclusion przez SQL Expressions (duckdb)

CVE-2023-3128CRITICAL9.4ten sam produkt

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is no...