Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the grafana-9.2.10-4.el9 build changelog.

  - account takeover possible when using Azure AD OAuth (CVE-2023-3128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-6972 advisory.

  - Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is     not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure     AD OAuth is configured with a multi-tenant app. (CVE-2023-3128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6972 advisory.

  - grafana: account takeover possible when using Azure AD OAuth (CVE-2023-3128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2917-1 advisory.

  - Grafana is an open-source platform for monitoring and observability. The option to send a test alert is     not available from the user panel UI for users having the Viewer role. It is still possible for a user     with the Viewer role to send a test alert using the API as the API does not check access to this function.
    This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail     and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version     9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix. (CVE-2023-2183)

  - Grafana is an open-source platform for monitoring and observability. Using public dashboards users can     query multiple distinct data sources using mixed queries. However such query has a possibility of crashing     a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's     also possible to cause this by calling the query API directly. This might enable malicious users to crash     Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
    (CVE-2023-2801)

  - Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is     not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure     AD OAuth is configured with a multi-tenant app. (CVE-2023-3128)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-4030 advisory.

  - Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is     not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure     AD OAuth is configured with a multi-tenant app. (CVE-2023-3128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:4030 advisory.

  - Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is     not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure     AD OAuth is configured with a multi-tenant app. (CVE-2023-3128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:4030 advisory.

  - Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is     not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure     AD OAuth is configured with a multi-tenant app. (CVE-2023-3128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:4030 advisory.

  - grafana: account takeover possible when using Azure AD OAuth (CVE-2023-3128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fdbe9aec-118b-11ee-908a-6c3be5272acd advisory.

  - Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is     not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure     AD OAuth is configured with a multi-tenant app. (CVE-2023-3128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191351	CentOS 9 : grafana-9.2.10-4.el9	Nessus	CentOS Local Security Checks	critical
186091	Oracle Linux 8 : grafana (ELSA-2023-6972)	Nessus	Oracle Linux Local Security Checks	critical
185687	RHEL 8 : grafana (RHSA-2023:6972)	Nessus	Red Hat Local Security Checks	critical
178694	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:2917-1)	Nessus	SuSE Local Security Checks	critical
178577	Oracle Linux 9 : grafana (ELSA-2023-4030)	Nessus	Oracle Linux Local Security Checks	critical
178491	Rocky Linux 9 : grafana (RLSA-2023:4030)	Nessus	Rocky Linux Local Security Checks	critical
178194	AlmaLinux 9 : grafana (ALSA-2023:4030)	Nessus	Alma Linux Local Security Checks	critical
178182	RHEL 9 : grafana (RHSA-2023:4030)	Nessus	Red Hat Local Security Checks	critical
177596	FreeBSD : Grafana -- Account takeover / authentication bypass (fdbe9aec-118b-11ee-908a-6c3be5272acd)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2023-3128

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical