description: Grafana is validating Azure AD accounts based on the email claim.
On Azure AD, the profile email field is not unique and can be easily modified.
This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
problem types: CWE-290
affected:
{
defaultStatus: unaffected
product: Grafana
vendor: Grafana
versions:
lessThan: 9.5.4, status: affected, version: 9.5.0, versionType: semver
lessThan: 9.4.13, status: affected, version: 9.4.0, versionType: semver
lessThan: 9.3.16, status: affected, version: 9.3.0, versionType: semver
lessThan: 9.2.20, status: affected, version: 9.2.0, versionType: semver
lessThan: 8.5.27, status: affected, version: 6.7.0, versionType: semver
}
{
defaultStatus: unaffected
product: Grafana Enterprise
vendor: Grafana
versions:
lessThan: 9.5.4, status: affected, version: 9.5.0, versionType: semver
lessThan: 9.4.13, status: affected, version: 9.4.0, versionType: semver
lessThan: 9.3.16, status: affected, version: 9.3.0, versionType: semver
lessThan: 9.2.20, status: affected, version: 9.2.0, versionType: semver
lessThan: 8.5.27, status: affected, version: 6.7.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL