Critical severity · published Jun 22, 2023
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim
9.8
CVSS
4%
EPSS
No
On KEV
Description
Grafana is validating Azure AD accounts based on the email claim.
On Azure AD, the profile email field is not unique and can be easily modified.
This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
6.7.0 before 8.5.27; 6.7.0 before 8.5.27; 9.2.0 before 9.2.20; 9.2.0 before 9.2.20; 9.3.0 before 9.3.16; 9.3.0 before 9.3.16; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3128
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3128
Vendor Advisory
https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp
Vendor Advisory
https://grafana.com/security/security-advisories/cve-2023-3128/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230714-0004/
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.8
CVE-2025-41115
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user…
9.8
CVE-2022-28660
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used
9.8
CVE-2022-26148
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix