Verification Bypass in Email Settings in Grafana
Medium
- Advisory ID:
- CVE-2023-6152
- Published:
- 2024-02-13
- Product:
- Grafana
- CVSS Score:
- 5.4
- CVSS Vector:
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Fixed Versions:
- >=10.3.3>=10.2.4>=10.1.7>=10.0.11>=9.5.16
Summary
Grafana is an open-source platform for monitoring and observability. A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. This issue has been patched in versions 10.3.3, 10.2.4, 10.1.7, 10.0.11 and 9.5.16.