CVE-2023-6152
CVE-2023-6152
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.
CVSS 5.4 · Medium · EPSS 1.4% · Fix available
- Published
- Updated
Stack: system · applications
Affected products and versions
grafana
- Versions
- ≥ 2.5.0, < 9.5.16: Affected (semver)
- ≥ 10.0.0, < 10.0.11: Affected (semver)
- ≥ 10.1.0, < 10.1.7: Affected (semver)
- ≥ 10.2.0, < 10.2.4: Affected (semver)
- ≥ 10.3.0, < 10.3.3: Affected (semver)
Update to 10.0.11; Update to 10.1.7; Update to 10.2.4; Update to 10.3.3; Update to 9.5.16
grafana Ubuntu:16.04:LTS
- Versions
- 2.6.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published