Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2023-6152

A user changing their email after signing up and verifying it can change it without verification in profile settings.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana

  • 2.5.0 to < 9.5.16affected
  • 10.0.0 to < 10.0.11affected
  • 10.1.0 to < 10.1.7affected
  • 10.2.0 to < 10.2.4affected
  • 10.3.0 to < 10.3.3affected

Grafana Grafana Enterprise

  • 2.5.0 to < 9.5.16affected
  • 10.0.0 to < 10.0.11affected
  • 10.1.0 to < 10.1.7affected
  • 10.2.0 to < 10.2.4affected
  • 10.3.0 to < 10.3.3affected

References