CVE-2023-4399

7.2 highEPSS 1.3%

High (7.2) in grafana grafana. EPSS 1.3% chance of exploitation in the next 30 days.

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the characters in the request address.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWE: CWE-183
Published: 2023-10-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

grafana:grafana

References

https://grafana.com/security/security-advisories/cve-2023-4399/
https://security.netapp.com/advisory/ntap-20231208-0003/
https://grafana.com/security/security-advisories/cve-2023-4399/
https://security.netapp.com/advisory/ntap-20231208-0003/

Check your stack JSON