PT-2023-8977 · Grafana+3 · Grafana+3
Negrel
·
Publicado
2023-11-10
·
Atualizado
2025-02-14
·
CVE-2023-6152
CVSS v2.0
5.5
Média
| Vetor | AV:N/AC:L/Au:S/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Grafana (affected versions not specified)
Description
The issue is related to a weakness in the authentication mechanism of Grafana, specifically with the
verify email enabled option. This option only validates email addresses during the sign-up process, allowing a user to change their email address without verification in their profile settings. An attacker can exploit this to bypass email verification and potentially prevent the legitimate owner of an email address from signing up. Additionally, a user can set their username to an email address that is different from their actual email address, which can also be used to prevent the legitimate owner of that email address from signing up.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Grafana
Red Os
Suse