Vulnerability · Published Jun 22, 2023 · Assigned by GRAFANA
CVE-2023-3128
Critical 9.4
In plain English
A critical-severity authentication bypass by spoofing in Grafana from Grafana. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | grafana | 9.2.10-7.el8_9.alma.1 | ALSA-2023:6972 |
| AlmaLinux:9 | grafana | 9.0.9-3.el9_2.alma | ALSA-2023:4030 |
| Go | github.com/grafana/grafana | 9.4.13 | GHSA-mpv3-g8m3-3fjc |
| Go | github.com/grafana/grafana | 8.5.27 | GHSA-mpv3-g8m3-3fjc |
| Go | github.com/grafana/grafana | 9.3.16 | GHSA-mpv3-g8m3-3fjc |
| Go | github.com/grafana/grafana | 9.2.20 | GHSA-mpv3-g8m3-3fjc |
| Rocky Linux:9 | grafana | 0:9.0.9-3.el9_2 | RLSA-2023:4030 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana | 9.5.0 – before 9.5.49.4.0 – before 9.4.139.3.0 – before 9.3.169.2.0 – before 9.2.206.7.0 – before 8.5.27 |
| Grafana | Grafana Enterprise | 9.5.0 – before 9.5.49.4.0 – before 9.4.139.3.0 – before 9.3.169.2.0 – before 9.2.206.7.0 – before 8.5.27 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L