Lucene search
GitHub Advisory DatabaseGHSA-MPV3-G8M3-3FJCHistoryJun 22, 2023 - 9:30 p.m.
Grafana vulnerable to Authentication Bypass by Spoofing
2023-06-2221:30:49
CWE-290
GitHub Advisory Database
github.com
31
0.001 Low
EPSS
Percentile
40.9%
Grafana is validating Azure AD accounts based on the email claim.
On Azure AD, the profile email field is not unique and can be easily modified.
This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
References
github.com/advisories/GHSA-mpv3-g8m3-3fjc
github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp
github.com/grafana/grafana/blob/69fc4e6bc0be2a82085ab3885c2262a4d49e97d8/CHANGELOG.md
grafana.com/security/security-advisories/cve-2023-3128/
nvd.nist.gov/vuln/detail/CVE-2023-3128
security.netapp.com/advisory/ntap-20230714-0004/
Related
nessus
nessus
Oracle Linux 9 : grafana (ELSA-2023-4030)
2023-07-20 00:00:00
RHEL 9 : grafana (RHSA-2023:4030)
2023-07-12 00:00:00
Oracle Linux 8 : grafana (ELSA-2023-6972)
2023-11-21 00:00:00
prion
prion
Authentication flaw
2023-06-22 21:15:00
almalinux
almalinux
Critical: grafana security update
2023-07-12 00:00:00
Moderate: grafana security and enhancement update
2023-11-14 00:00:00
redhatcve
redhatcve
CVE-2023-3128
2023-06-23 03:16:58
openvas
openvas
veracode
veracode
Authentication Bypass
2023-07-05 10:26:37
oraclelinux
oraclelinux
grafana security update
2023-07-19 00:00:00
grafana security and enhancement update
2023-11-17 00:00:00
cve
cve
CVE-2023-3128
2023-06-22 21:15:09
alpinelinux
alpinelinux
CVE-2023-3128
2023-06-22 21:15:00
osv
osv
Grafana vulnerable to Authentication Bypass by Spoofing
2023-06-22 21:30:49
BIT-grafana-2023-3128
2024-03-06 10:53:06
CVE-2023-3128
2023-06-22 21:15:09
rocky
rocky
grafana security update
2023-07-19 17:53:40
redhat
redhat
(RHSA-2023:4030) Critical: grafana security update
2023-07-12 03:05:36
(RHSA-2023:6972) Moderate: grafana security and enhancement update
2023-11-14 08:41:59
rosalinux
rosalinux
Advisory ROSA-SA-2023-2181
2023-07-04 13:37:03
freebsd
freebsd
Grafana -- Account takeover / authentication bypass
2023-06-22 00:00:00
cvelist
cvelist
CVE-2023-3128
2023-06-22 20:14:00
thn
thn
redos
redos
ROS-20240404-01
2024-04-04 00:00:00