CVE-2023-3128

CVE-2023-3128 CVE-2023-3128 취약점인증 우회, Azure AD 이메일 클레임 검증 문제로 인한 Grafana 취약점에 대해 도메인이 취약한지 확인하려면 다음 Python 스크립트를 사용할 수 있습니다: !/usr/bin/env python3 import requests import argparse def checkcve20233128targeturl, verbose=False: """Check for CVE-2023-3128 vulnerability""" session = requests.Session...

grafana: account takeover possible when using Azure AD OAuth

A flaw was found in Grafana, which validates Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique across Azure AD tenants, which enables Grafana account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant AzureAD OAuth...