VDB
CVE-2023-3128
CVE-2023-3128
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
EPSS 3.99% · 89.9th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
3.99%
89.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | grafana | 6.7.0, 9.2.0, 9.3.0 |
| Bitnami | grafana | 9.2.0, 9.3.0, 9.4.0 |
Timeline
- Jun 22, 2023 CVE Published
- Jun 23, 2023 EPSS Score
- Sep 2, 2023 EPSS Score
- Oct 7, 2023 EPSS Score
- Dec 17, 2023 EPSS Score
- Feb 25, 2024 EPSS Score
- May 6, 2024 EPSS Score
- Jun 10, 2024 EPSS Score
- Aug 20, 2024 EPSS Score
- Oct 30, 2024 EPSS Score
- Jan 10, 2025 EPSS Score
- Feb 13, 2025 CVE Updated