Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2023-3128
9.4
CRITICALCVSS v3
Severity scale
010
Description
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
grafana/grafana
GitHubThe open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.
GitHubThe open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more. >= 9.5.0, < 9.5.4, >= 9.4.0, < 9.4.13, >= 9.3.0, < 9.3.16, >= 9.2.0, < 9.2.20, >= 6.7.0, < 8.5.27NVD
grafana/grafana
Docker HubThe official Grafana docker container
Docker HubThe official Grafana docker container>= 9.5.0, < 9.5.4, >= 9.4.0, < 9.4.13, >= 9.3.0, < 9.3.16, >= 9.2.0, < 9.2.20, >= 6.7.0, < 8.5.27NVD
Chocolatey
RubyGems
NPM