Skip to content
OpenAdvisories
Critical RHSA-2023:4030 1 CVE

Red Hat Security Advisory: grafana security update

Published Sep 16, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana 0:9.0.9-3.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana-debuginfo 0:9.0.9-3.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana-debugsource 0:9.0.9-3.el9_2

Vulnerabilities 1

  • Critical 9.4
    CVE-2023-3128 Public exploit

    Grafana vulnerable to Authentication Bypass by Spoofing

    Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

    Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu Go

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2213626
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4030.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-3128
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-3128
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-3128
  • article
    https://grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/