CVSS 3.1 Score 7.2 of 10 (high)


Published Oct 17, 2023
Updated: Dec 8, 2023
CWE ID 183


CVE-2023-4399 is a vulnerability that affects Grafana, an open-source platform for monitoring and observability. In Grafana Enterprise, there is a feature called Request security, which allows administrators to configure the instance to not call specific hosts. However, this restriction can be bypassed by using punycode encoding of the characters in the request address. The vulnerability has a base severity rating of HIGH (7.2) and can potentially have a significant impact on confidentiality and integrity. It requires high privileges to exploit and does not require user interaction. The affected products include various versions of Grafana Enterprise and Grafana Hub. To remediate this vulnerability, users should update to the latest version of Grafana that includes a fix for this issue.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-4399 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options