Email Verification Bypassed in Profile Settings
CVE-2023-6152

5.4MEDIUM

Key Information:

What is CVE-2023-6152?

A user changing their email after signing up and verifying it can change it without verification in profile settings.

The configuration option "verify_email_enabled" will only validate email only on sign up.

Grafana 2.5.0 < 9.5.16

Grafana 10.0.0 < 10.0.11

Grafana 10.1.0 < 10.1.7

Score:

5.4

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet