CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LCVE-2023-6152
Medium (5.4) in grafana grafana. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in github.com/grafana/grafana 10.0.11, 10.1.7, 10.2.4.
A user changing their email after signing up and verifying it can change it without verification in profile settings.
The configuration option "verify_email_enabled" will only validate email only on sign up.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-11-01)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- grafana:grafana
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3hv4-r2fm-h27f | Go | github.com/grafana/grafana | >=2.5.0 <9.5.16 | 9.5.16 |
| GHSA-3hv4-r2fm-h27f | Go | github.com/grafana/grafana | >=10.0.0 <10.0.11 | 10.0.11 |
| GHSA-3hv4-r2fm-h27f | Go | github.com/grafana/grafana | >=10.1.0 <10.1.7 | 10.1.7 |
| GHSA-3hv4-r2fm-h27f | Go | github.com/grafana/grafana | >=10.2.0 <10.2.4 | 10.2.4 |
| GHSA-3hv4-r2fm-h27f | Go | github.com/grafana/grafana | >=10.3.0 <10.3.3 | 10.3.3 |
References
- https://github.com/grafana/bugbounty/security/advisories/GHSA-3hv4-r2fm-h27f
- https://grafana.com/security/security-advisories/cve-2023-6152/
- https://github.com/grafana/bugbounty/security/advisories/GHSA-3hv4-r2fm-h27f
- https://grafana.com/security/security-advisories/cve-2023-6152/
- https://security.netapp.com/advisory/ntap-20250214-0008/