CyberSecBulletin
CVE-2023-4399NVD status: Modified

Grafana Enterprise: Permissive List of Allowed Inputs

Published Updated By the CyberSecBulletin desk

CVE-2023-4399 is a high-severity permissive list of allowed inputs vulnerability in Grafana Enterprise from Grafana, with a CVSS 3.1 base score of 7.2 out of 10. It can be exploited remotely over the network by an attacker with administrator privileges, without any action from a user. The record lists versions 10.1.5, 10.0.9, 9.5.13 as the first without the flaw, so updating Grafana Enterprise to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.31% chance of exploitation within 30 days, higher than 71% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Grafana Enterprise to 10.1.5 or 10.0.9 or 9.5.13 or 9.4.17, whichever matches your release line, or a later version.
  2. Update Grafana to 9.4.17 or 9.5.13 or 10.0.9 or 10.1.5, whichever matches your release line, or a later version.
  3. Read the advisory on grafana.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
GrafanaGrafana Enterprise10.1.0 up to, but not including, 10.1.5; 10.0.0 up to, but not including, 10.0.9; 9.5.0 up to, but not including, 9.5.13; 9.4.0 up to, but not including, 9.4.1710.1.5, 10.0.9, 9.5.13, 9.4.17
GrafanaGrafana9.4.0 up to, but not including, 9.4.17; 9.5.0 up to, but not including, 9.5.13; 10.0.0 up to, but not including, 10.0.9; 10.1.0 up to, but not including, 10.1.59.4.17, 9.5.13, 10.0.9, 10.1.5

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
HighAdministrator-level access is required first.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.16.6MediumCNA (grafana.com)
CVSS 3.17.2HighNVD

Official description

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the characters in the request address.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Permissive List of Allowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

More Permissive List of Allowed Inputs vulnerabilities (CWE-183)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Grafana Enterprise

All Grafana Enterprise vulnerabilities

Spotted an error? Tell us.