CVE-2023-6152 Email Validation Bypass And Preventing Sign Up From Email's Owner
Attackers can bypass email verification to change their account email, potentially leading to account takeover in Grafana.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-6152?
CVE-2023-6152 is a medium-severity vulnerability in Grafana Grafana, published on 13 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A user changing their email after signing up and verifying it can change it without verification in profile settings.
The configuration option "verify_email_enabled" will only validate email only on sign up.
Weakness: CWE-863
Which versions are affected by CVE-2023-6152?
11 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | From 10.0.0 | 10.0.11 |
github.com/grafana/grafana Go | From 10.0.0 | 10.0.11 |
github.com/grafana/grafana Go | From 10.1.0 | 10.1.7 |
github.com/grafana/grafana Go | From 10.1.0 | 10.1.7 |
github.com/grafana/grafana Go | From 10.2.0 | 10.2.4 |
github.com/grafana/grafana Go | From 10.2.0 | 10.2.4 |
5 more packages
github.com/grafana/grafana Go | From 10.3.0 | 10.3.3 |
github.com/grafana/grafana Go | From 10.3.0 | 10.3.3 |
github.com/grafana/grafana Go | From 2.5.0 | 9.5.16 |
github.com/grafana/grafana Go | From 2.5.0 | 9.5.16 |
grafana Bitnami | From 2.5.0 | 9.5.16, 10.0.11, 10.1.7, 10.2.4, 10.3.3 |
Linux distribution packages (9)
golang-github-prometheus-alertmanager SUSE:Manager Client Tools 12-BETA | All versions | 0.26.0-4.18.2 |
golang-github-prometheus-node_exporter SUSE:Manager Client Tools 12-BETA | All versions | 1.7.0-4.18.2 |
golang-github-prometheus-promu SUSE:Manager Client Tools 12-BETA | All versions | 0.14.0-4.15.1 |
grafana SUSE:Manager Client Tools 12-BETA | All versions | 9.5.16-4.27.1 |
spacecmd SUSE:Manager Client Tools 12-BETA | All versions | 5.0.5-41.48.1 |
spacewalk-client-tools SUSE:Manager Client Tools 12-BETA | All versions | 5.0.4-55.51.1 |
supportutils-plugin-susemanager-client SUSE:Manager Client Tools 12-BETA | All versions | 5.0.3-9.21.1 |
uyuni-tools SUSE:Manager Client Tools 12-BETA | All versions | 0.1.7-3.8.1 |
grafana openSUSE:Tumbleweed | All versions | 10.1.7-1.1 |
Products include Grafana Grafana.
How do I fix CVE-2023-6152?
Upgrade github.com/grafana/grafana to a fixed version for your release line: 10.0.11, 10.1.7, 10.2.4 or 10.3.3.
Is CVE-2023-6152 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-6152 exists.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2023-6152, GHSA-3hv4-r2fm-h27f, SUSE-SU-2024:1419-1, UBUNTU-CVE-2023-6152, openSUSE-SU-2024:13713-1.