CVE-2023-4399
Grafana 9.4.0 – 9.4.17
Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-4399 is a medium-severity Permissive List of Allowed Inputs (CWE-183) vulnerability in Grafana Grafana. Its CVSS base score is 6.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked in the top 35% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54262
Vulnerability Data
Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be…
more
bypassed used punycode encoding of the characters in the request address.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.2V4.4.2
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require rigorous allow-list design and testing that prevents permissive input validation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Application security requirements can mandate strict, minimal allow-lists and input validation rules that prevent overly permissive lists.
A.8.27 mandates security-by-design principles (least privilege, default-deny, distrust-external-input, secure session control, data validation/sanitization, assume-breach) that reach many but not all permissive-allowlist cases; a bounded remainder (e.g. custom business-logic allowlists whose enumerated safe values are chosen incorrectly) can still be introduced and exploited.
Secure coding standards enforce rigorous input validation and reject unsafe values, mitigating permissive allow-list weaknesses.
Security testing can detect overly broad allow-lists, but does not inherently prevent their creation.