kritik
CVE-2023-3128
grafana: account takeover possible when using Azure AD OAuth
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, AlmaLinux, Bitnami, Rocky Linux. Daha düşük diyenler: Red Hat (orta), Oracle (orta).
Açıklama
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 8 | grafana | 9.2.10-7.el8_9.alma.1 |
| alma 9 | grafana | 9.0.9-3.el9_2.alma |
| bitnami::Bitnami Vulnerability Database | grafana | 8.5.27, 9.2.20, 9.3.16, 9.4.13, 9.5.4 |
| go::GitHub Security Advisory Go | github.com/grafana/grafana | 9.4.13, 9.3.16, 9.2.20, 8.5.27 |
| rocky 9 | grafana | 9.0.9-3.el9_2 |
| Oracle Linux 8 | grafana | 9.2.10-7.el8_9 |
| Oracle Linux 9 | grafana | 9.0.9-3.el9_2 |
| rapidfort Oracle Linux 9 | grafana | 0:9.0.9-3.el9_2 |
| Red Hat | servicemesh-grafana | düzeltme belirtilmemiş |
Referanslar
- https://access.redhat.com/errata/RHSA-2023:4030
- https://access.redhat.com/security/cve/CVE-2023-3128
- https://bugzilla.redhat.com/2213626
- https://bugzilla.redhat.com/show_bug.cgi?id=2213626
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3128
- https://errata.almalinux.org/9/ALSA-2023-4030.html
- https://errata.rockylinux.org/RLSA-2023:4030
20 referansın hepsi
- https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp
- https://github.com/grafana/grafana
- https://github.com/grafana/grafana/blob/69fc4e6bc0be2a82085ab3885c2262a4d49e97d8/CHANGELOG.md
- https://grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/
- https://grafana.com/security/security-advisories/cve-2023-3128
- https://grafana.com/security/security-advisories/cve-2023-3128/
- https://linux.oracle.com/cve/CVE-2023-3128.html
- https://linux.oracle.com/errata/ELSA-2023-6972.html
- https://nvd.nist.gov/vuln/detail/CVE-2023-3128
- https://security.netapp.com/advisory/ntap-20230714-0004
- https://security.netapp.com/advisory/ntap-20230714-0004/
- https://www.cve.org/CVERecord?id=CVE-2023-3128