by Kastro
Paper/Archive/CVE-2023-3128

CVE-2023-3128

Grafana Grafana — Grafana is validating Azure AD accounts based on the email claim.

EPSS 4%public exploitCVSS 9.8
critical.is priorityof 100
58
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 90.5.905 × 2018.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

Affected

ProductAffectedFixed inSource
Grafana9.5.0 – < 9.5.49.5.4CNA
Grafana9.4.0 – < 9.4.139.4.13CNA
Grafana9.3.0 – < 9.3.169.3.16CNA
Grafana9.2.0 – < 9.2.209.2.20CNA
Grafana6.7.0 – < 8.5.278.5.27CNA
Grafana Enterprise9.5.0 – < 9.5.49.5.4CNA
Grafana Enterprise9.4.0 – < 9.4.139.4.13CNA
Grafana Enterprise9.3.0 – < 9.3.169.3.16CNA
Grafana Enterprise9.2.0 – < 9.2.209.2.20CNA
Grafana Enterprise6.7.0 – < 8.5.278.5.27CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GRAFANA (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgrafana.com/security/security-advisories/cve-2023-3128refgithub.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgprefsecurity.netapp.com/advisory/ntap-20230714-0004