PRIOn knowledge basePRION:CVE-2023-3128

HistoryJun 22, 2023 - 9:15 p.m.

Authentication flaw

2023-06-2221:15:00

PRIOn knowledge base

www.prio-n.com

grafana

azure ad

account validation

email claim

profile field

unique

modified

account takeover

authentication bypass

oauth

multi-tenant app

9.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.3%

JSON

Grafana is validating Azure AD accounts based on the email claim.

On Azure AD, the profile email field is not unique and can be easily modified.

This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

CPENameOperatorVersion
grafanage9.5.0
grafanalt9.5.4
grafanage9.4.0
grafanalt9.4.13
grafanage9.3.0
grafanalt9.3.16
grafanage9.2.0
grafanalt9.2.20
grafanage6.7.0
grafanalt8.5.27

Name	Operator	Version
grafana	ge	9.5.0
grafana	lt	9.5.4
grafana	ge	9.4.0
grafana	lt	9.4.13
grafana	ge	9.3.0
grafana	lt	9.3.16
grafana	ge	9.2.0
grafana	lt	9.2.20
grafana	ge	6.7.0
grafana	lt	8.5.27

Rows per page:

1-10 of 201

References

github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp

grafana.com/security/security-advisories/cve-2023-3128/

security.netapp.com/advisory/ntap-20230714-0004/