DeutschShown in its original language — a full translation is planned for a future version.
Grafana: Schwachstelle ermöglicht Übernahme von Benutzerkonto
view advisory published 2023-06-22
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Grafana ausnutzen, um ein Benutzerkonto zu übernehmen.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-3128US | critical9.8 | Exploit | ||
Grafana is validating Azure AD accounts based on the email claim.
On Azure AD, the profile email field is not unique and can be easily modified.
This leads to account takeover… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2023:4030 vom 2023-07-12external
- Red Hat Security Advisory RHSA-2023:6972 vom 2023-11-15external
- Red Hat Security Advisory RHSA-2024:3925 vom 2024-06-14external
- Red Hat Security Advisory RHSA-2024:4591 vom 2024-07-17external
- Grafana Security Advisory vom 2023-06-22external
- SUSE Security Update SUSE-SU-2025:0545-1 vom 2025-02-14external
- SUSE Security Update SUSE-SU-2023:3136-1 vom 2023-08-02external
- SUSE Security Update SUSE-SU-2024:0196-1 vom 2024-01-23external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan