CVE-2023-6152

Severity Score

5.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

A user changing their email after signing up and verifying it can change it without verification in profile settings.

The configuration option "verify_email_enabled" will only validate email only on sign up.

Un usuario que cambia su correo electrónico después de registrarse y verificarlo puede cambiarlo sin verificación en la configuración del perfil. La opción de configuración "verify_email_enabled" solo validará el correo electrónico al registrarse.

*Credits: N/A

CVSS Scores

Grafana Labsv3.1 5.4

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

Poc

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-11-15 CVE Reserved
2024-02-13 CVE Published
2024-08-22 CVE Updated
2024-10-22 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-863: Incorrect Authorization

CAPEC

CAPEC-115: Authentication Bypass

References (2)

URL	Tag	Source
https://github.com/grafana/bugbounty/security/advisories/GHSA-3hv4-r2fm-h27f
https://grafana.com/security/security-advisories/cve-2023-6152

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 2.5.0 < 9.5.16 Search vendor "Grafana" for product "Grafana" and version " >= 2.5.0 < 9.5.16"		en		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 10.0.0 < 10.0.11 Search vendor "Grafana" for product "Grafana" and version " >= 10.0.0 < 10.0.11"		en		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 10.1.0 < 10.1.7 Search vendor "Grafana" for product "Grafana" and version " >= 10.1.0 < 10.1.7"		en		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 10.2.0 < 10.2.4 Search vendor "Grafana" for product "Grafana" and version " >= 10.2.0 < 10.2.4"		en		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 10.3.0 < 10.3.3 Search vendor "Grafana" for product "Grafana" and version " >= 10.3.0 < 10.3.3"		en		Affected
Grafana Search vendor "Grafana"		Grafana Enterprise Search vendor "Grafana" for product "Grafana Enterprise"				>= 2.5.0 < 9.5.16 Search vendor "Grafana" for product "Grafana Enterprise" and version " >= 2.5.0 < 9.5.16"		en		Affected
Grafana Search vendor "Grafana"		Grafana Enterprise Search vendor "Grafana" for product "Grafana Enterprise"				>= 10.0.0 < 10.0.11 Search vendor "Grafana" for product "Grafana Enterprise" and version " >= 10.0.0 < 10.0.11"		en		Affected
Grafana Search vendor "Grafana"		Grafana Enterprise Search vendor "Grafana" for product "Grafana Enterprise"				>= 10.1.0 < 10.1.7 Search vendor "Grafana" for product "Grafana Enterprise" and version " >= 10.1.0 < 10.1.7"		en		Affected
Grafana Search vendor "Grafana"		Grafana Enterprise Search vendor "Grafana" for product "Grafana Enterprise"				>= 10.2.0 < 10.2.4 Search vendor "Grafana" for product "Grafana Enterprise" and version " >= 10.2.0 < 10.2.4"		en		Affected
Grafana Search vendor "Grafana"		Grafana Enterprise Search vendor "Grafana" for product "Grafana Enterprise"				>= 10.3.0 < 10.3.3 Search vendor "Grafana" for product "Grafana Enterprise" and version " >= 10.3.0 < 10.3.3"		en		Affected