CVE-2023-3128

CVSS Score of 10 (low)

Details

Published Jun 22, 2023
Updated: Jul 21, 2023
CWE ID 290

Summary

CVE-2023-3128 is a vulnerability affecting Grafana, specifically when it validates Azure AD accounts based on the email claim. The issue arises from the fact that the profile email field in Azure AD is not unique and can be easily modified. This vulnerability can lead to account takeover and authentication bypass if Azure AD OAuth is configured with a multi-tenant app. It poses a high risk to organizations as it allows unauthorized access to sensitive information and resources. The vulnerability has a CVSS score of 9.8, indicating its critical severity. To remediate this vulnerability, organizations should ensure that they have implemented strong authentication mechanisms and validate user identities through more secure means.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-3128 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options