-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from using Azure AD's mutable email claim for authentication instead of the immutable subject (sub) identifier. The primary vulnerable function would be in the Azure AD OAuth handler where user identity is established. While exact code isn't shown, Grafana's architecture patterns suggest the UserInfo method in AzureADProvider would handle claim extraction, and SocialBase would contain generic OAuth claim processing logic. The high confidence for AzureADProvider comes from Microsoft's explicit guidance against email-based identification, while the SocialBase function gets medium confidence as it's a common pattern in OAuth implementations.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/grafana/grafana | go | >= 9.4.0, < 9.4.13 | 9.4.13 |
| github.com/grafana/grafana | go | >= 9.3.0, < 9.3.16 | 9.3.16 |
| github.com/grafana/grafana |
| go |
| >= 9.0.0, < 9.2.20 |
| 9.2.20 |
| github.com/grafana/grafana | go | < 8.5.27 | 8.5.27 |
Ongoing coverage of React2Shell