VDB
CVE-2023-3128
CVE-2023-3128
PUBLISHED
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
EPSS 1.88% · 83.5th percentile
Risk Scores
EPSS Score
1.88%
83.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | grafana | 6.7.0, 9.2.0, 9.3.0 |
| Bitnami | grafana | 9.2.0, 9.3.0, 9.4.0 |
Timeline
- Jun 22, 2023 CVE Published
- Jun 23, 2023 EPSS Score
- Sep 1, 2023 EPSS Score
- Oct 7, 2023 EPSS Score
- Dec 16, 2023 EPSS Score
- Feb 25, 2024 EPSS Score
- Mar 31, 2024 EPSS Score
- Jun 9, 2024 EPSS Score
- Aug 19, 2024 EPSS Score
- Sep 23, 2024 EPSS Score
- Dec 4, 2024 EPSS Score
- Feb 12, 2025 EPSS Score