Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-3128

Good to know:

icon

Date: June 22, 2023

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

Language: Go

Severity Score

Related Resources (10)

https://nvd.nist.gov/vuln/detail/CVE-2023-3128
https://grafana.com/security/security-advisories/cve-2023-3128
https://github.com/grafana/grafana
https://security.netapp.com/advisory/ntap-20230714-0004/
https://access.redhat.com/security/cve/CVE-2023-3128
https://github.com/grafana/grafana/blob/69fc4e6bc0be2a82085ab3885c2262a4d49e97d8/CHANGELOG.md
https://security.netapp.com/advisory/ntap-20230714-0004
https://grafana.com/security/security-advisories/cve-2023-3128/
https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp
https://www.mend.io/vulnerability-database/CVE-2023-3128

Severity Score

Weakness Type (CWE)

Authentication Bypass by Spoofing

CWE-290

Top Fix

icon

Upgrade Version

Upgrade to version v8.5.27,v9.2.20,v9.3.16,v9.4.13,v9.5.4

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): LOW

Do you need more information?

Contact Us