VDB
CVE-2023-3128
CVE-2023-3128
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
EPSS 3.99% · 90.5th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
3.99%
90.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | grafana | 6.7.0, 9.2.0, 9.3.0 |
| Bitnami | grafana | 9.2.0, 9.3.0, 9.4.0 |
Timeline
- Jun 22, 2023 CVE Published
- Jun 23, 2023 EPSS Score
- Sep 2, 2023 EPSS Score
- Oct 8, 2023 EPSS Score
- Dec 18, 2023 EPSS Score
- Feb 27, 2024 EPSS Score
- Apr 2, 2024 EPSS Score
- Jun 12, 2024 EPSS Score
- Aug 22, 2024 EPSS Score
- Nov 1, 2024 EPSS Score
- Dec 8, 2024 EPSS Score
- Feb 13, 2025 CVE Updated