Description

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

Remediation

References

CVE-2023-3128

Related Vulnerabilities

AbanteCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2016-10755)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2009-4300)

Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-0276)

SugarCRM Other Vulnerability (CVE-2006-2460)

WordPress Plugin Batch-Move Posts Unspecified Vulnerability (1.5)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-290 CVE-2023-3128