Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2023-3128

Grafana is validating Azure AD accounts based on the email claim.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana

Default version status: unaffected

  • 9.5.0 to < 9.5.4affected
  • 9.4.0 to < 9.4.13affected
  • 9.3.0 to < 9.3.16affected
  • 9.2.0 to < 9.2.20affected
  • 6.7.0 to < 8.5.27affected

Grafana Grafana Enterprise

Default version status: unaffected

  • 9.5.0 to < 9.5.4affected
  • 9.4.0 to < 9.4.13affected
  • 9.3.0 to < 9.3.16affected
  • 9.2.0 to < 9.2.20affected
  • 6.7.0 to < 8.5.27affected

References