CVE-2023-3128

CRITICAL9.4

Grafana is validating Azure AD accounts based on the email claim

Published Jun 22, 2023

Modified 11 months ago

Grafana is validating Azure AD accounts based on the email claim.

On Azure AD, the profile email field is not unique and can be easily modified.

This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

CVSS v3.1

9.4

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

LowA:L

9.4/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Other

PublishedJun 22, 2023

ModifiedFeb 13, 2025

CVE-2023-3128 | Mondoo Vulnerability Intelligence