PT-2023-8915 · Grafana+2 · Grafana+2

Leixiao · Published 2023-10-17 · Updated 2024-09-12 · CVE-2023-4399

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)

Description The issue is related to a bypass of the deny list in Grafana, which is an open-source platform for monitoring and observability. This bypass can be achieved by using punycode encoding of characters in the request address, allowing a remote attacker to circumvent existing access restrictions. The vulnerability is related to the Request security feature in Grafana Enterprise, which is designed to prevent the instance from calling specific hosts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-183

Related Identifiers

ALT-PU-2023-7440

ALT-PU-2024-12406

ALT-PU-2024-2190

ALT-PU-2024-7863

BDU:2024-02599

BIT-GRAFANA-2023-4399

CVE-2023-4399

Affected Products

Alt Linux

Grafana

Red Os

References · 20

• https://grafana.com/security/security-advisories/cve-2023-4399 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2024-2190 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4399 · Security Note
• https://bdu.fstec.ru/vul/2024-02599 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4399 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2024-7863 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02572 · Security Note
• https://errata.altlinux.org/ALT-PU-2024-12406 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-7440 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4822 · Security Note
• https://osv.dev/vulnerability/BIT-grafana-2023-4399 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4399 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4399 · Note
• https://twitter.com/VulmonFeeds/status/1714228934273851896 · Twitter Post
• https://redos.red-soft.ru/support/secure · Note