CVE-2023-3128
CriticalCVSS 9.4Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
Grafana validates Azure AD accounts based on the email claim. The email field in Azure AD profiles is not unique and can be easily modified, leading to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
Risk Assessment
The organization may be exposed to account takeover, which can lead to unauthorized access to resources. This poses a serious threat to data and system security.
Recommendation
It is recommended to implement additional identity verification mechanisms and to monitor and audit user accounts in Azure AD. Consider restricting access to multi-tenant applications.
Original NVD description (English source)
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.