Description
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
Affected products
- Grafana / Grafana9.5.0 – 9.5.4
- Grafana / Grafana9.4.0 – 9.4.13
- Grafana / Grafana9.3.0 – 9.3.16
- Grafana / Grafana9.2.0 – 9.2.20
- Grafana / Grafana6.7.0 – 8.5.27
- Grafana / Grafana Enterprise9.5.0 – 9.5.4
- Grafana / Grafana Enterprise9.4.0 – 9.4.13
- Grafana / Grafana Enterprise9.3.0 – 9.3.16
- Grafana / Grafana Enterprise9.2.0 – 9.2.20
- Grafana / Grafana Enterprise6.7.0 – 8.5.27