GitHub Advisoryadvisory · Go

GHSA-mpv3-g8m3-3fjc Grafana vulnerable to Authentication Bypass by Spoofing

CRITICAL Published 2023-06-22 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-3128
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-290
Reviewed
2023-06-23

Affected packages

• Go github.com/grafana/grafana: >= 9.4.0, < 9.4.13 → fixed in 9.4.13 • Go github.com/grafana/grafana: >= 9.3.0, < 9.3.16 → fixed in 9.3.16 • Go github.com/grafana/grafana: >= 9.0.0, < 9.2.20 → fixed in 9.2.20 • Go github.com/grafana/grafana: < 8.5.27 → fixed in 8.5.27

Description

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

Related

Alias · CVE (1)

  • CVE-2023-3128 Grafana is validating Azure AD accounts based on the email claim. vulnerability

Weakness · CWE (1)

  • CWE-290 Authentication Bypass by Spoofing weakness

References