kritisch
CVE-2023-3128
grafana: account takeover possible when using Azure AD OAuth
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, AlmaLinux, Bitnami, Rocky Linux. Niedriger laut Red Hat (mittel), Oracle (mittel).
Beschreibung
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 8 | grafana | 9.2.10-7.el8_9.alma.1 |
| alma 9 | grafana | 9.0.9-3.el9_2.alma |
| bitnami::Bitnami Vulnerability Database | grafana | 8.5.27, 9.2.20, 9.3.16, 9.4.13, 9.5.4 |
| go::GitHub Security Advisory Go | github.com/grafana/grafana | 9.4.13, 9.3.16, 9.2.20, 8.5.27 |
| rocky 9 | grafana | 9.0.9-3.el9_2 |
| Oracle Linux 8 | grafana | 9.2.10-7.el8_9 |
| Oracle Linux 9 | grafana | 9.0.9-3.el9_2 |
| rapidfort Oracle Linux 9 | grafana | 0:9.0.9-3.el9_2 |
| Red Hat | servicemesh-grafana | kein Fix angegeben |
Referenzen
- https://access.redhat.com/errata/RHSA-2023:4030
- https://access.redhat.com/security/cve/CVE-2023-3128
- https://bugzilla.redhat.com/2213626
- https://bugzilla.redhat.com/show_bug.cgi?id=2213626
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3128
- https://errata.almalinux.org/9/ALSA-2023-4030.html
- https://errata.rockylinux.org/RLSA-2023:4030
Alle 20 Referenzen
- https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp
- https://github.com/grafana/grafana
- https://github.com/grafana/grafana/blob/69fc4e6bc0be2a82085ab3885c2262a4d49e97d8/CHANGELOG.md
- https://grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/
- https://grafana.com/security/security-advisories/cve-2023-3128
- https://grafana.com/security/security-advisories/cve-2023-3128/
- https://linux.oracle.com/cve/CVE-2023-3128.html
- https://linux.oracle.com/errata/ELSA-2023-6972.html
- https://nvd.nist.gov/vuln/detail/CVE-2023-3128
- https://security.netapp.com/advisory/ntap-20230714-0004
- https://security.netapp.com/advisory/ntap-20230714-0004/
- https://www.cve.org/CVERecord?id=CVE-2023-3128