Cyber Resilience

CVE-2023-4399

Grafana 9.4.0 – 9.4.17

Published
17 October 2023
Modified
13 February 2025
Patch / advisory
CVSS Score v3.1 6.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.011 62th percentile
Risk Priority 47 floored blend · peak EPSS

Summary

CVE-2023-4399 is a medium-severity Permissive List of Allowed Inputs (CWE-183) vulnerability in Grafana Grafana. Its CVSS base score is 6.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be…

more

bypassed used punycode encoding of the characters in the request address.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-10452Same product: Grafana Grafana
CVE-2023-5122Same product: Grafana Grafana
CVE-2021-43798Same product: Grafana Grafana
CVE-2026-10601Same product: Grafana Grafana
CVE-2023-0507Same product: Grafana Grafana
CVE-2023-1410Same product: Grafana Grafana
CVE-2026-9029Same product: Grafana Grafana
CVE-2023-0594Same product: Grafana Grafana
CVE-2026-28380Same product: Grafana Grafana
CVE-2026-8595Same product: Grafana Grafana

Affected Assets

grafana
grafana
9.4.0 — 9.4.17 · 9.5.0 — 9.5.13 · 10.0.0 — 10.0.9

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.5.2
  • V4.4.2

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require rigorous allow-list design and testing that prevents permissive input validation.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect overly broad allow-lists, but does not inherently prevent their creation.

prevents

Application security requirements can mandate strict, minimal allow-lists and input validation rules that prevent overly permissive lists.

prevents

Secure system architecture and engineering principles require explicit, least-privilege input validation designs that directly address permissive allow-lists.

prevents

Secure coding standards enforce rigorous input validation and reject unsafe values, mitigating permissive allow-list weaknesses.

none

Configuration management can enforce validated input rules, yet does not directly address the design flaw of permissive lists.

References