PT-2023-22805 · Atlassian · Jira

Nilmerg · Publicado 2023-07-05 · Atualizado 2023-07-11 · CVE-2023-30607

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions icingaweb2-module-jira versions 1.3.0 through 1.3.2

Description The issue affects the integration with Atlassian Jira, where template and field configuration forms perform deletion actions before validating user input, including the cross-site request forgery token. This allows for potential unauthorized actions. The problem is fixed in version 1.3.2.

Recommendations For versions 1.3.0 through 1.3.1, update to version 1.3.2 to resolve the issue. For version 1.3.2, no action is required as this version already contains the fix.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-30607

GHSA-GH7W-7F7J-GWP5

Produtos afetados

Jira

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30607.json · Exploit
• https://github.com/Icinga/icingaweb2-module-jira/commit/7f0c53b7a3e87be2f4c2e8840805d7b7c9762424 · Correção
• https://github.com/Icinga/icingaweb2-module-jira/security/advisories/GHSA-gh7w-7f7j-gwp5 · Aviso do Fabricante
• https://github.com/Icinga/icingaweb2-module-jira/releases/tag/v1.3.2 · Nota
• https://t.me/cvenotify/54100 · Publicação no Telegram
• https://t.me/cibsecurity/66008 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-30607 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-30607 · Aviso do Fabricante