Description

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

Remediation

References

CVE-2023-3128

Related Vulnerabilities

WordPress Plugin Yoast SEO Cross-Site Scripting (20.2)

Handlebars Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-8861)

IBMHttpServer Other Vulnerability (CVE-2002-1822)

MySQL CVE-2018-3075 Vulnerability (CVE-2018-3075)

WordPress Plugin Events Manager Extended 'admin.php' SQL Injection (3.1.2)

Severity

Critical

Classification

CVE-2023-3128 CWE-290 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities