CVE-2023-3128
Summary
| CVE | CVE-2023-3128 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-06-22 21:15:00 UTC |
| Updated | 2023-07-21 19:19:00 UTC |
| Description | Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app. |
Risk And Classification
Problem Types: CWE-290
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Authentication bypass / account takeover due to bad implementation of Azure AD OAuth · Advisory · grafana/bugbounty · GitHub | MISC | github.com | |
| 403 Forbidden | MISC | security.netapp.com | |
| Grafana authentication bypass using Azure AD OAuth | Grafana Labs | MISC | grafana.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160790 Oracle Enterprise Linux Security Update for grafana (ELSA-2023-4030)
- 161171 Oracle Enterprise Linux Security Update for grafana security and enhancement update (ELSA-2023-6972)
- 241783 Red Hat Update for grafana (RHSA-2023:4030)
- 242413 Red Hat Update for grafana (RHSA-2023:6972)
- 379637 Alibaba Cloud Linux Security Update for grafana security and enhancement update (moderate) (ALINUX3-SA-2024:0038)
- 691197 Free Berkeley Software Distribution (FreeBSD) Security Update for grafana (fdbe9aec-118b-11ee-908a-6c3be5272acd)
- 730833 Grafana Authentication Bypass Vulnerability
- 941170 AlmaLinux Security Update for grafana (ALSA-2023:4030)
- 941470 AlmaLinux Security Update for grafana (ALSA-2023:6972)
- 960957 Rocky Linux Security Update for grafana (RLSA-2023:4030)