Description
Grafana is an open-source platform for monitoring and observability.
In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts.
However, the restriction can be bypassed used punycode encoding of the characters in the request address.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise | 10.1.0 – < 10.1.5, 10.0.0 – < 10.0.9, 9.5.0 – < 9.5.13, 9.4.0 – < 9.4.17 | 10.1.5 |
Advisories 1
- WID-SEC-2023-2666 Grafana: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 17, 2023