Skip to content
OpenAdvisories
Critical ELSA-2023-4030 1 CVE

Critical: grafana security update (Oracle Linux 9)

Published Jul 19, 2023 · Updated Jul 19, 2023

Ecosystem: Oracle Linux

Summary

[9.0.9-3]
- resolve CVE-2023-3128 grafana: Remove Email Lookup from oauth integrations
(rhbz#2213701 rhbz#2213626)

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 grafana 0:9.0.9-3.el9_2

Vulnerabilities 1

  • Critical 9.4
    CVE-2023-3128 Public exploit

    Grafana vulnerable to Authentication Bypass by Spoofing

    Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

    Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu Go