9.4
Critique
CVE-2023-3128 Grafana is validating Azure AD accounts based on the email claim
Description
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| grafana 9.5 | 9.5.0 → < 9.5.4 | 9.5.4 |
| grafana 9.4 | 9.4.0 → < 9.4.13 | 9.4.13 |
| grafana 9.3 | 9.3.0 → < 9.3.16 | 9.3.16 |
| grafana 9.2 | 9.2.0 → < 9.2.20 | 9.2.20 |
| grafana 6.7 | 6.7.0 → < 8.5.27 | 8.5.27 |
| Grafana Enterprise 9.5 | 9.5.0 → < 9.5.4 | 9.5.4 |
| Grafana Enterprise 9.4 | 9.4.0 → < 9.4.13 | 9.4.13 |
| Grafana Enterprise 9.3 | 9.3.0 → < 9.3.16 | 9.3.16 |
| Grafana Enterprise 9.2 | 9.2.0 → < 9.2.20 | 9.2.20 |
Afficher l’autre branche Masquer l’autre branche
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Grafana Enterprise 6.7 | 6.7.0 → < 8.5.27 | 8.5.27 |
Références
- grafana.com grafana.com
- github.com github.com
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de grafana
Les 59 CVE de grafana →
CVE-2026-27879
A resample query can be used to trigger out-of-memory crashes in Grafana
6.5
Moyenne
CVE-2026-28375
A testdata data-source can be used to trigger out-of-memory crashes in Grafana
6.5
Moyenne
CVE-2026-27876
RCE on Grafana via sqlExpressions
9.1
Critique
CVE-2026-27880
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory…
7.5
Élevée