BIT-grafana-2023-3128

BIT-grafana-2023-3128 PUBLISHED CVSS 9.800000190734863 CRITICAL

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

Risk Scores

CVSS 3.1

9.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Bitnami	grafana	6.7.0, 9.2.0, 9.3.0

Timeline

Mar 6, 2024 CVE Published
Mar 16, 2026 CVE Updated

References

https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp url
https://grafana.com/security/security-advisories/cve-2023-3128/ url
https://security.netapp.com/advisory/ntap-20230714-0004/ url
https://nvd.nist.gov/vuln/detail/CVE-2023-3128 url

Open in Interactive Console →