CVE-2023-6152

2024-02-1321:38:01

CWE-863

GRAFANA

github.com

user verification

email change

security vulnerability

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

7.2

Confidence

Low

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A user changing their email after signing up and verifying it can change it without verification in profile settings.

The configuration option “verify_email_enabled” will only validate email only on sign up.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*"
    ],
    "vendor": "grafana",
    "product": "grafana",
    "versions": [
      {
        "status": "affected",
        "version": "2.5.0",
        "lessThan": "9.5.16",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.0.0",
        "lessThan": "10.0.11",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.10",
        "lessThan": "10.1.7",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.2.0",
        "lessThan": "10.2.4",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.3.0",
        "lessThan": "10.3.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:grafana:grafana_enterprise:*:*:*:*:*:*:*:*"
    ],
    "vendor": "grafana",
    "product": "grafana_enterprise",
    "versions": [
      {
        "status": "affected",
        "version": "2.5.0",
        "lessThan": "9.5.16",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.0.0",
        "lessThan": "10.0.11",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.10",
        "lessThan": "10.1.7",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.2.0",
        "lessThan": "10.2.4",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.3.0",
        "lessThan": "10.3.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]