Test ID:	1.3.6.1.4.1.25623.1.0.124342
Category:	Web application abuses
Title:	Grafana 6.7.x < 8.5.27, 9.x < 9.2.20, 9.3.x < 9.3.16, 9.4.x < 9.4.13, 9.5.x < 9.5.5, 10.x < 10.0.1 Authentication Bypass Vulnerability
Summary:	Grafana is prone to an authentication bypass vulnerability.
Description:	Summary: Grafana is prone to an authentication bypass vulnerability. Vulnerability Insight: Grafana validates Azure Active Directory accounts based on the email claim. On Azure AD, the profile email field is not unique across Azure AD tenants. This can enable a Grafana account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant Azure AD OAuth application. Affected Software/OS: Grafana versions 6.7.x prior to 8.5.27, version 9.x prior to 9.2.20, 9.3.x prior to 9.3.16, 9.4.x prior to 9.4.13, 9.5.x prior to 9.5.5 and 10.x prior to 10.0.1. Solution: Update to version 8.5.27, 9.2.20, 9.3.16, 9.4.13, 9.5.5, 10.0.1 or later. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-3128 https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp https://grafana.com/security/security-advisories/cve-2023-3128/
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.