PT-2023-8658 · Atlassian · Jira

Rodrigo Gava · Publicado 2023-11-07 · Atualizado 2023-11-15 · CVE-2023-42361

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Better PDF Exporter for Jira Server and Jira Data Center versions 10.3.0 and before

Description The issue is related to insufficient server-side request validation in the Better PDF Exporter plugin for Atlassian Jira Server and Data Center. This can be exploited to view arbitrary files, potentially leading to other impacts. The vulnerability is exploited via the use of a crafted image during PDF export.

Recommendations For versions 10.3.0 and before, consider disabling the Better PDF Exporter plugin until a patch is available to prevent exploitation. Restrict access to sensitive files and directories to minimize the risk of arbitrary file viewing.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2024-01403

CVE-2023-42361

Produtos afetados

Jira

Referências · 9

• https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=versions&hosting=datacenter · Nota
• https://twitter.com/VulmonFeeds/status/1722041350168735827 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-42361 · Aviso do Fabricante
• https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=versions&hosting=server · Nota
• https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=versions&hosting=datacenter · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-42361 · Nota de Segurança
• https://gccybermonks.com/posts/pdfjira · Nota
• https://bdu.fstec.ru/vul/2024-01403 · Nota de Segurança
• https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=versions&hosting=server · Nota