PT-2023-8977 · Grafana+3 · Grafana+3
Negrel
·
Published
2023-11-10
·
Updated
2025-02-14
·
CVE-2023-6152
CVSS v2.0
5.5
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Grafana (affected versions not specified)
Description
The issue is related to a weakness in the authentication mechanism of Grafana, specifically with the
verify email enabled option. This option only validates email addresses during the sign-up process, allowing a user to change their email address without verification in their profile settings. An attacker can exploit this to bypass email verification and potentially prevent the legitimate owner of an email address from signing up. Additionally, a user can set their username to an email address that is different from their actual email address, which can also be used to prevent the legitimate owner of that email address from signing up.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Grafana
Red Os
Suse