Description (CNA)
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Grafana / Grafana | affected 2.5.0 before 9.5.16; affected 10.0.0 before 10.0.11; affected 10.1.0 before 10.1.7; affected 10.2.0 before 10.2.4; affected 10.3.0 before 10.3.3 |
| Grafana / Grafana Enterprise | affected 2.5.0 before 9.5.16; affected 10.0.0 before 10.0.11; affected 10.1.0 before 10.1.7; affected 10.2.0 before 10.2.4; affected 10.3.0 before 10.3.3 |
CWE
CWE-863
References
- https://grafana.com/security/security-advisories/cve-2023-6152/
- https://github.com/grafana/bugbounty/security/advisories/GHSA-3hv4-r2fm-h27f
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.