CVE-2023-3128

CVE-2023-3128 Para verificar si un dominio es vulnerable a CVE-2023-3128, que implica un bypass de autenticación en Grafana debido a la validación de afirmación de correo electrónico de Azure AD, puedes usar el siguiente script de Python: !/usr/bin/env python3 import requests import argparse def...

grafana: account takeover possible when using Azure AD OAuth

A flaw was found in Grafana, which validates Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique across Azure AD tenants, which enables Grafana account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant AzureAD OAuth...